ralphwalkerdj
asked on
Expunge a file so it cannot be retrieved under any circumstances. Is this possible?????
I have a work computer that is being taken away very unexpectedly. I have one day to retrieve some files, but I'm afraid they've already copied them and will use them against me to fire me.
a) The last time I got past my password and did anything with any files was a week ago. I'm agraid they've copied all of my files. There are some VERY sensitive personal correspondances on the computer that I never intended to be read. How can I know, other than that the computer was turn on and they found they couldn't get past my password, that they didn't do anything else yesterday (like an administrator came in yesterday and copied them).
b) I know that it's real easy to get a file back once it's been deleted. In fact, someone told me that even if you run a disc format, a file can be retrieved (which I find hard to believe!) My problem is that I cannot reformat the entire drive. But I do need to completely erase all traces of any files so that one of those file retrieving programs could never get them. What can I do? I'm almost thinking that if I put all of the files in a folder, then somehow corrupted them with a virus or something that would not spread to the rest of the computer, they'd be impossible to retrieve in their full capacity. What are your suggestions?
a) The last time I got past my password and did anything with any files was a week ago. I'm agraid they've copied all of my files. There are some VERY sensitive personal correspondances on the computer that I never intended to be read. How can I know, other than that the computer was turn on and they found they couldn't get past my password, that they didn't do anything else yesterday (like an administrator came in yesterday and copied them).
b) I know that it's real easy to get a file back once it's been deleted. In fact, someone told me that even if you run a disc format, a file can be retrieved (which I find hard to believe!) My problem is that I cannot reformat the entire drive. But I do need to completely erase all traces of any files so that one of those file retrieving programs could never get them. What can I do? I'm almost thinking that if I put all of the files in a folder, then somehow corrupted them with a virus or something that would not spread to the rest of the computer, they'd be impossible to retrieve in their full capacity. What are your suggestions?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you both, but you did not address this question: how do I know if the computer has been "entered" within the past 24 hours?
To the best of my knowledge you won't unless you already had some sort of monitoring/auditing in place.
You could use event viewer to sift through recent Security Logs....a tedious task that might indicate whether an Administrator was on your machine or not (either locally or via a share), but you won't know what (if any) files were copied.
You could use event viewer to sift through recent Security Logs....a tedious task that might indicate whether an Administrator was on your machine or not (either locally or via a share), but you won't know what (if any) files were copied.
You need to look at the Event logs to see the activity on your computer.
support.microsoft.com/kb/3
support.microsoft.com/kb/3
ASKER
I don't care about that. I know the computer was turned on, because they called me and asked me for my pass word. What I want to know is if they got one of their geeks who was able to somehow bypass it and get into Windows. Wouldn't there be some log that shows that?
You'll probably want to check the Security log for Event 528 (successfull logon) - it would also show that your username was used.
ASKER
Thank you very much. There's no way they'd be able get to my password unless it was hacked. That aside, can you please walk me thru checking how to do Security Log for Event 528? This will partially answer my question.
Go to Control Panel | Administrative Tools | Event Viewer - once the viewer opens switch to the Security log along the left-hand side. In the resultant pane to the right you'll see all the security events.
Click the column header named 'Events' and it will sort everything by event number (so all the 528's will be grouped together); then you can find recent Logons that have been logged.
Click the column header named 'Events' and it will sort everything by event number (so all the 528's will be grouped together); then you can find recent Logons that have been logged.
I would start by gathering & deleting all the personal data from your computer. At this point the files are deleted and the disk space is marked as 'free' to the system; but the data is still recoverable until the system actually needs that space and overwrites the old data.
This is where a program like KillDisk (for example) comes in handy:
http://www.killdisk.com/
It will wipe out all that unused space on a disk that is marked as free, leaving all other files/folders intact, and your original/personal data will be purged forever.