System and method for removing residual data from memory

• US 20070073792A1
• Filed: 09/28/2005
• Published: 03/29/2007
• Est. Priority Date: 09/28/2005
• Status: Abandoned Application

• Current Assignee: Webroot Software Incorporated (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Nichols, Tony, Carpenter, Troy
• Application Number:
  US11/237,575
• Publication Number:
  US 20070073792A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen

Abstract

Systems and methods for removing residual data on a protected computer are described. In one variation, the location of a directory structure is a file storage device of the protected computer are identified. Information from the directory structure is retrieved and analyzed to determine whether residual data exists in the directory structure. Any existing residual data is removed.

Claims

1. A method for removing residual data on a protected computer while substantially circumventing an operating system of the protected computer comprising:

identifying a location of a directory structure in a file storage device of the protected computer, wherein the directory structure is stored in an original memory space;

retrieving information from the directory structure;

analyzing the information from the directory structure to determine whether the residual data exists in the directory structure; and

removing the residual data if it exists in the directory structure.

2. The method according to claim 1, wherein

the directory structure operates in an NT File System,

the directory structure is a master file table (MFT), and

the residual data resides in at least one directory structure record that is selected from the group consisting of at least one directory structure record available to be rewritten and at least one directory structure record that is not in-use.

3. The method according to claim 1, wherein the analyzing comprises:

scanning the directory structure;

identifying a location of at least one directory structure record; and

accessing the at least one directory structure record to determine if the residual data exists in the at least one directory structure record.

4. The method of claim 1, wherein the residual data is all data in the directory structure except for data that allows the operating system to recognize the directory structure as a type of directory structure.

5. The method of claim 1, wherein the removing comprises erasing the residual data so the residual data cannot be recovered by a means selected from the group consisting of spyware, forensic software, disc viewing, and disc recovery.

6. The method of claim 1, wherein the removing comprises erasing the residual data from a disk drive memory so as to leave the disk drive memory of the protected computer in a state as if the residual data had never existed.

7. The method of claim 1, wherein the removing comprises:

saving at least one record of the directory structure to a temporary memory space, wherein the at least one record contains the residual data;

accessing the at least one record;

updating, in the temporary memory space, every byte between the end of a header and a last byte of the at least one record with a first overwrite character, thereby creating a first updated at least one record; and

saving the first updated at least one record to the original memory space.

8. The method of claim 7, wherein the removing further comprises:

accessing the first updated at least one record;

updating, in the temporary memory space, every byte between the end the of the header and the last byte of the first updated at least one record with a second overwrite character, thereby creating a second updated at least one record;

saving the second updated at least one record to the original memory space;

accessing the second updated at least one record;

updating, in the temporary memory space, every byte between the end the of the header and the last byte of the second updated at least one record with a third overwrite character, thereby creating a third updated at least one record;

saving the third updated at least one record to the original memory space;

accessing the third updated at least one record;

updating, in the temporary memory space, every byte between the end the of the header and the last byte of the third updated at least one record with a fourth overwrite character, thereby creating a fourth updated at least one record; and

saving the fourth updated at least one record to the original memory space.

9. A computer-readable medium comprising executable instructions that remove residual data on a protected computer while substantially circumventing an operating system of the protected computer, wherein the executable instructions comprise instructions to:

identify a location of a directory structure in a file storage device of the protected computer, wherein the directory structure is stored in an original memory space;

retrieve information from the directory structure;

analyze the information from the directory structure to determine whether the residual data exists in the directory structure; and

remove the residual data if it exists in the directory structure.

10. The computer-readable medium of claim 9, wherein

the executable instructions operate in an NT File System,

the directory structure is a master file table (MFT),

the residual data resides in at least one directory structure record that is selected from the group consisting of at least one directory structure record available to be rewritten and at least one directory structure record that is not in-use, and

the residual data is all data in the directory structure except for data that allows the operating system to recognize the directory structure as a type of directory structure.

11. The computer-readable medium of claim 9, wherein the executable instruction to analyze the information from the directory structure to determine whether the residual data exists in the directory structure includes executable instructions to:

scan the directory structure;

identify a location of at least one directory structure record; and

access the at least one directory structure record to determine if the residual data exists in the at least one directory structure record.

12. The computer-readable medium of claim 9, wherein the executable instruction to remove the residual data if it exists in the directory structure includes executable instructions to erase the residual data so the residual data cannot be recovered by a means selected from the group consisting of spyware, forensic software, disc viewing, and disc recovery.

13. The computer-readable medium of claim 9, wherein the executable instruction to remove the residual data if it exists in the directory structure includes executable instructions to:

save at least one record of the directory structure to a temporary memory space, wherein the at least one record contains the residual data;

access the at least one record;

update, in the temporary memory space, every byte between the end of a header and a last byte of the at least one record with a first overwrite character, thereby creating a first updated at least one record; and

save the first updated at least one record to the original memory space.

14. The computer-readable medium of claim 13, wherein the executable instruction to remove the residual data if it exists in the directory structure further includes executable instructions to:

access the first updated at least one record;

update, in the temporary memory space, every byte between the end the of the header and the last byte of the first updated at least one record with a second overwrite character, thereby creating a second updated at least one record;

save the second updated at least one record to the original memory space;

access the second updated at least one record;

update, in the temporary memory space, every byte between the end the of the header and the last byte of the second updated at least one record with a third overwrite character, thereby creating a third updated at least one record;

save the third updated at least one record to the original memory space;

access the third updated at least one record;

update, in the temporary memory space, every byte between the end the of the header and the last byte of the third updated at least one record with a fourth overwrite character, thereby creating a fourth updated at least one record; and

save the fourth updated at least one record to the original memory space.

15. A system of removing residual data on a protected computer while substantially circumventing an operating system of the protected computer, comprising:

a detection module configured to;

identify a location of a directory structure in a file storage device of the protected computer, wherein the directory structure is stored in an original memory space;

a file access module configured to;

retrieve information from the directory structure; and

a removal module configured to;

analyze the information from the directory structure to determine whether the residual data exists in the directory structure; and

remove the residual data if it exists in the directory structure.

16. The system of claim 15, wherein

the system is an NT File System,

the directory structure is a master file table (MFT),

the residual data resides in at least one directory structure record that is selected from the group consisting of at least one directory structure record available to be rewritten and at least one directory structure record that is not in-use, and

the residual data is all data in the directory structure except for data that allows the operating system to recognize the directory structure as a type of directory structure.

17. The system of claim 15, wherein the removal module configured to analyze the information from the directory structure to determine whether the residual data exists in the directory structure is further configured to:

scan the directory structure;

identify a location of at least one directory structure record; and

access the at least one directory structure record to determine if the residual data exists in the at least one directory structure record.

18. The system of claim 15, wherein the removal module configured to remove the residual data if it exists in the directory structure is further configured to erase the residual data so the residual data cannot be recovered by a means selected from the group consisting of spyware, forensic software, disc viewing, and disc recovery.

19. The system of claim 15, wherein the removal module configured to remove the residual data if it exists in the directory structure is further configured to:

save at least one record of the directory structure to a temporary memory space, wherein the at least one record contains the residual data;

access the at least one record;

update, in the temporary memory space, every byte between the end of a header and a last byte of the at least one record with a first overwrite character, thereby creating a first updated at least one record; and

save the first updated at least one record to the original memory space.

20. The system of claim 19, wherein the removal module configured to remove the residual data if it exists in the directory structure is further configured to:

access the first updated at least one record;

update, in the temporary memory space, every byte between the end the of the header and the last byte of the first updated at least one record with a second overwrite character, thereby creating a second updated at least one record;

save the second updated at least one record to the original memory space;

access the second updated at least one record;

update, in the temporary memory space, every byte between the end the of the header and the last byte of the second updated at least one record with a third overwrite character, thereby creating a third updated at least one record;

save the third updated at least one record to the original memory space;

access the third updated at least one record;

update, in the temporary memory space, every byte between the end the of the header and the last byte of the third updated at least one record with a fourth overwrite character, thereby creating a fourth updated at least one record; and

save the fourth updated at least one record to the original memory space.