Method and system for securely deleting files from a computer storage device

• US 20080010326A1
• Filed: 06/15/2006
• Published: 01/10/2008
• Est. Priority Date: 06/15/2006
• Status: Abandoned Application

• Current Assignee: Webroot Software Incorporated (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Nichols, Tony, Carpenter, Troy A.
• Application Number:
  US11/454,097
• Publication Number:
  US 20080010326A1
• Time in Patent Office: Days
• US Class Current: 707/205
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0652 Erasing, e.g. deleting, data cleaning, moving of data to a wastebasket
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

A method and system for securely deleting files from a computer storage device is described. One embodiment locates a data structure associated with a file to be deleted; locates, using information contained in the data structure, the set of data storage units in which the file resides; and overwrites with a data pattern at least once each data storage unit in the set of data storage units, the overwriting being performed using direct drive access, the direct drive access bypassing standard file Application Program Interface (API) function calls of the operating system of the computer.

Claims

1. A method for securely deleting a file from a storage device of a computer, the method comprising:

locating a data structure associated with the file, the file being contained in a set of data storage units on the storage device;

locating, using information contained in the data structure, the set of data storage units; and

overwriting with a data pattern at least once each data storage unit in the set of data storage units, the overwriting being performed using direct drive access, the direct drive access bypassing standard file Application Program Interface (API) function calls of an operating system of the computer.

2. The method of claim 1, further comprising:

overwriting with a data pattern at least once a directory entry associated with the file using direct drive access, the direct drive access bypassing the standard file Application Program Interface (API) function calls of the operating system.

3. The method of claim 1, wherein the data structure associated with the file is one of an entry in a Master File Table (MFT) associated with a New Technology File System (NTFS) and an entry in a File Allocation Table (FAT) associated with a FAT file system.

4. The method of claim 1, wherein each data storage unit in the set of data storage units is a sector.

5. A method for removing files from a storage device of a computer, the method comprising:

identifying at least one file to be removed from the storage device, each of the at least one file having associated data; and

performing the following for each of the at least one file;

locating a data structure associated with the file;

locating, using information contained in the data structure, the data associated with the file;

overwriting with a data pattern at least once the data associated with the file using standard file Application Program Interface (API) function calls of an operating system of the computer, when a first file removal mode is selected; and

overwriting with a data pattern at least once the data associated with the file using direct drive access, when a second file removal mode is selected, the direct drive access bypassing the standard file Application Program Interface (API) function calls of the operating system.

6. The method of claim 5, further comprising:

overwriting with a data pattern at least once a directory entry associated with the file using direct drive access, when the second file removal mode is selected, the direct drive access bypassing the standard file Application Program Interface (API) function calls of the operating system.

7. The method of claim 5, wherein the data structure associated with the file is one of an entry in a Master File Table (MFT) associated with a New Technology File System (NTFS) and an entry in a File Allocation Table (FAT) associated with a FAT file system.

8. A system for securely deleting a file from a storage device of a computer, the system comprising:

a data location module configured to;

locate a data structure associated with the file, the file being contained in a set of data storage units on the storage device; and

locate, using information contained in the data structure, the set of data storage units; and

a secure data overwrite module configured to overwrite with a data pattern at least once each data storage unit in the set of data storage units using direct drive access, the direct drive access bypassing standard file Application Program Interface (API) function calls of an operating system of the computer.

9. The system of claim 8, wherein the secure data overwrite module is further configured to overwrite with a data pattern at least once a directory entry associated with the file using direct drive access, the direct drive access bypassing the standard file Application Program Interface (API) function calls of the operating system.

10. The system of claim 8, wherein the data structure associated with the file is one of an entry in a Master File Table (MFT) associated with a New Technology File System (NTFS) and an entry in a File Allocation Table (FAT) associated with a FAT file system.

11. The system of claim 8, wherein each data storage unit in the set of data storage units is a sector.

12. A system for removing files from a storage device of a computer, the system comprising:

a file deletion queue including at least one file to be removed from the storage device;

a data location module configured to;

locate, for each of the at least one file, a data structure associated with that file; and

locate, for each of the at least one file, data constituting that file using information contained in the data structure associated with that file;

a non-secure data overwrite module configured, for each of the at least one file, to overwrite with a data pattern at least once the data constituting that file using standard file Application Program Interface (API) function calls of an operating system of the computer, when a non-secure file removal mode is selected; and

a secure data overwrite module configured, for each of the at least one file, to overwrite with a data pattern at least once the data constituting that file using direct drive access, when a secure file removal mode is selected, the direct drive access bypassing the standard file Application Program Interface (API) function calls of the operating system.

13. The system of claim 12, wherein the secure data overwrite module is further configured, for each of the at least one file, to overwrite with a data pattern at least once a directory entry associated with that file using direct drive access, when the secure file removal mode is selected, the direct drive access bypassing the standard file Application Program Interface (API) function calls of the operating system.

14. The system of claim 12, wherein the data structure associated with each of the at least one file is one of an entry in a Master File Table (MFT) associated with a New Technology File System (NTFS) and an entry in a File Allocation Table (FAT) associated with a FAT file system.

15. A system for securely deleting a file from a storage device of a computer, the system comprising:

means for locating a data structure associated with the file, the file being contained in a set of data storage units on the storage device;

means for locating, using information contained in the data structure, the set of data storage units; and

means for overwriting with a data pattern at least once each data storage unit in the set of data storage units, the overwriting being performed using direct drive access, the direct drive access bypassing standard file Application Program Interface (API) function calls of an operating system of the computer.

16. A system for removing files from a storage device of a computer, the system comprising:

means for identifying at least one file to be removed from the storage device;

means for locating, for each of the at least one file, a data structure associated with that file;

means for locating, for each of the at least one file, data constituting that file using information contained in the data structure associated with that file;

means, operative upon each of the at least one file, for overwriting with a data pattern at least once the data constituting that file using standard file Application Program Interface (API) function calls of an operating system of the computer, when a non-secure file removal mode is selected; and

means, operative upon each of the at least one file, for overwriting with a data pattern at least once the data constituting that file using direct drive access, when a secure file removal mode is selected, the direct drive access bypassing the standard file Application Program Interface (API) function calls of the operating system.

17. A computer-readable storage medium having program instructions executable by a processor to delete securely a file from a storage device of a computer, the program instructions comprising:

a first instruction segment configured to locate a data structure associated with the file, the file being contained in a set of data storage units on the storage device;

a second instruction segment configured to locate, using information contained in the data structure, the set of data storage units; and

a third instruction segment configured to overwrite with a data pattern at least once each data storage unit in the set of data storage units using direct drive access, the direct drive access bypassing standard file Application Program Interface (API) function calls of an operating system of the computer.

18. A computer-readable storage medium having program instructions executable by a processor to remove files from a storage device of a computer, the program instructions comprising:

a first code segment configured to identify at least one file to be removed from the storage device, each of the at least one file having associated data; and

a second code segment configured, for each of the at least one file, to;

locate a data structure associated with the file;

locate, using information contained in the data structure, the data associated with the file;

overwrite with a data pattern at least once the data associated with the file using standard file Application Program Interface (API) function calls of an operating system of the computer, when a first file removal mode is selected; and

overwrite with a data pattern at least once the data associated with the file using direct drive access, when a second file removal mode is selected, the direct drive access bypassing the standard file Application Program Interface (API) function calls of the operating system.