How to VIOLENTLY delete files from NTFS partitions?

From time to time, a person decides that his operating system is too screwed (constant errors, crashes, slowdowns) and decides that he wants to reinstall it FROM SCRATCH, i.e. make sure that no traces of the system remain.

One simple way to do it would be to format the partition, but what if there are a few gigs of valuable stuff on that partition and no way to move them / back them up (no additional partitions, no recordable media with enough storage capacity)?

If it was something running of FAT32, I'd simply boot into DOS mode with my Win98 boot disk and delete all the system files manually:

C:\WINDOWS or C:\WINNT - GONE!
C:\Program Files - GONE!
C:\*.* - GONE!
C:\Documents and Settings - GONE! (after moving all the vital stuff to another folder)

Simple, no?

But how do I do it when my OS is installed on a NTFS partition with all its file permissions and protections?

Any simple way?

If your data is really that valuable you should find some way to back it up properly. If you want a complete Windows reinstall from scratch then you need to reformat your installation partition to get rid of any left-overs from your old Windows install (bye-bye precious data).

Hard drives are cheap these days, as are CD-RWs and DVD writers are coming down in price. I know forking out for stuff is never a joyful experience but it is better to have your data safe before you start messing around (I'm speaking from many instances of painful experience: plan for the worst).

However, If you are intent on pursuing your current plan then you might find this useful:

http://www.nu2.nu/pebuilder/

BartPe is a customised boot CD which will give you access to any 2000/XP/2003 installation with a GUI, network and full file system support.

Originally posted by Curley_Boy:


Where would those left-overs be if not in the directories I mentioned? Why would I need to format?

Originally posted by Curley_Boy:


I'll try that, thanks.

You see, the reason I'm investigating this issue, is not just for my own PC. I _do_ have a DVD-Writer. But in the past I've been fixing and reinstalling systems for neighbors many times, and when you're doing it for someone else who doesn't want to lose his data, you can't say: "go and buy a DVD-writer or a hard disk first".

Of course, you can say: "you have no choice but to format", but it's always better if you have a choice.

for future refrence this is what I do and what I recommend.
When installing windows I create a 6 - 10 GB partition that is my C: drive and I install NOTHING but windows there. all My data, games etc I put on other partitions.
that way whenever I re-install windows (which I do at least twice a year)I wipe the C: drive and re-install and that way I still have all my valueble data stored on other partitions.
this is my current partition table

C: drive 6gb (windows only)
D: drive 30gb (games partition)
e: drive 30gb (games partition)
f: drive 30gb (video editing)
g: drive 20gb (application partition)

S

OK, I got it. Winternals NTFSDOS Professional is the key.

APK, AFAIK, all the feds, et al actually do is replace the read/write head with a more sensitive/powerful magnet.

Also, check out http://dban.sourceforge.net

Free (as in speech and beer) and good.


From the "News" section on the DBAN page:
March 2004: DBAN appears briefly in the TechTV Screen Savers episode How the Department of Energy Stays Secure. DBAN is part of the National Nuclear Security Administration suite of security tools.

This may sound TOO simple of a solution for some to grasp, but it is what i do when that case comes up.


PULL THE HARD DISK. PUT IT INTO YOUR COMPUTER. AND EITHER...

A. Backup all the data to your own drive somewhere, format the disk, and put the crucial data back.


OR

B. Simply delete all the windows, program files, doc and sets, etc. Make sure view all hidden files is enabled as well as system files viewable.


Something like this takes me a whole 10 minutes and i don't have to deal with DOS commands etc.

Ah, but in the topic I asked about "deleting files", not "deleting ALL files". Your method will not work if you only want to delete files selectively. A low-level format will erase everything, and the magnet method is one you absolutely don't know what it will do.



That's my method exactly. Unfortunately, you can't do it from within Windows, because the Windows run-time environment protects these files. So you need to boot into pure DOS and do it from there. But if the partition is NTFS, the standard pure DOS available on Win9x won't recognize it, so you need a tool like the NTFSDOS Professional.

Originally posted by Alec§taar:


I did read it, I just chose to reply to the low-level/magnet part of your post only. I assumed you meant in jokingly, so I joked back.

Originally posted by Alec§taar:


Ah, excuse me. Did anyone ask you "how do I delete files so that even the best recovery tools can't resurrect them?" Did you even read the original question? Really, it seemed like all you wanted to do was to brag about the "mega-kewl" program you wrote. Well, let me compliment you on your programming skills, which are without a doubt better than my own, and let me also compliment your ego, which is once again, without a doubt, bigger than my own.

Originally posted by Alec§taar:
.

Oh, I get it. So now you're going to tell me what I meant in my original topic. Now, I suppose you could claim that my choice of title "how to VIOLENTLY delete files from a partition" was misleading (evidently, it confused you), but if you at least bothered to read the original post, not the title, you'd quickly understand what problem I was trying to address, and that talking about magnets and federal data eradication policies is at the very least irrelevant.

Originally posted by Alec§taar:


Funny, I should say the same to you, since you clearly didn't bother to read what I wrote in my first post. Or maybe you did read it, but chose to ignore. In which case you shouldn't assume that I didn't read what you wrote just because I didn't reply to it.

Good read, thanks Alec.

I subscribe to the SecurityFocus Forensics mailing list, and there's always interesting discussions going on there, as well as legal issues.

Actually it is similar to SANS, although more categorized. SecurityFocus is the home of BugTraq, which you've no doubt heard of.

I subscribe to the 'digest' mailings, which have several threads in one email for easier reading (and less clutter).

Of course all of the lists can be read online too, here: http://securityfocus.com/archive

Originally posted by Alec§taar:


Yep, I am. Thanks, too, for the nice words. It's really an interesting and fulfilling job for me

LOL, Alec. Come on, man, you're just blabbing.

If you read and understood my original post (not just topic title - which you seem to be sticking too much to), you'd see that all I wanted was something to let me run DELTREE over a system directory on an NTFS drive, which is something I obviously can't do while Windows is running and something the Windows recovery console doesn't allow me and something I can't do from a FAT32 OS Bootdisk, because it cannot see NTFS partitions.

But even after I found a solution myself and posted here that I found it, you came and started talking about your program. With your experience and understanding of computers, couldn't you see that it was completely irrelevant? Did I, or anyone else in this topic exhibit interest in secure destruction of data, which makes it unrecoverable? And please, don't mention again that this is how you understood the topic title. Titles do not matter, many people just post something like "HELP". It's the contents that matters.

I don't mind that you and Adam had a nice chat in this topic on things that interest you and have no relevance to the topic itself, as I found my solution. But I do mind being treated as stupid and talked to in a condescending manner.

Actually dr_st, I thought when going into this thread it was going to be about permanent deletion of files as well. Then after reading your first sentence of your post I thought that was surely what it was about. But then by the end of your post I really wasn't sure exactly what you wanted. Did you want a way to permanently delete files, or did you want a way to delete just the os files? Now I know it was the latter, but in that case using the word violently and the phrase 'without a trace' was misleading. But let's forget about that. More importantly if you are going to post on a help forum and ask for help, that is what you did, do not attack the people that are trying to help you. Let's say he was trying to promote his program, it was still relevant to your request, thus it was still help, or an attempt at it.

It's the internet, relax.

Lastly, Alec, he's not worth your replies.

I've been on this forum for an hour or so and I've already noticed that Alec answers almost everyone's questions. That is why I felt like posting this. dr_st needs to be more grateful imo.

dr_st I am sure you will attack my post, but I'm not going to reply. This is a computer help forum, flaming has no place here. If you got what you needed then stop posting rants.

Fine. Let's conclude that I really screwed up there and couldn't formulate my request properly. Happens to the best of us.



I never attack anyone unless provoked. When someone talks to me like I'm an idiot and says things like Alec said in his post from 2004-07-24 07:22:37, I consider that provoking.



I'm pretty relaxed. I can be deeply cynical and vicious when relaxed, just like I can be Mr. Kindness even when nervous.



Luckily, your "imo" means nothing on this matter. I'm always grateful when people help. I try to be grateful if a person just tries to help, even if in the end he doesn't. Here I stopped being grateful at the instant I picked up the condescending vibes, because like I said, this is something I don't like.



Right on the money, chief.

So are you.

This isn't about being right or wrong here, it's about understanding the question and providing a relevant answer, which you didn't do (Don't argue with me here, please, I know what's relevant to me). In part it was because I probably didn't formulate my request clearly enough and for that I apologize.

Bygones.

"Blabbing" did not refer to your convo with Adam, but to you constantly trying to prove to me that you answered my question, when I was saying you didn't. My apologies again for being misunderstood.



Normally I don't get misunderstood in issues like this. At least not by people who have a clue. You definitely have a clue, which is why I am still surprised you couldn't understand my problem, even considering the fact that I didn't formulate it clear enough (again, seemed to me pretty standard a problem for everyone to understand, even without me giving graphic descriptions of typing DELTREE C:\WINDOWS)



Here's a challenge:
(1) Log in as the administrator with all the administrative rights and privileges.
(2) Shut down all processes except the system processes you can't shut down (and Explorer, which needs to be running)
(3) Try to delete C:\WINDOWS (or whatever your Win dir is).
(4) Tell me what happened.

The administrative rights are not the problem. The problem is during run time you cannot delete files which are protected by running processes. A lot of files in the Windows directory are just like that. To simplify, I always delete the Windows directory from DOS. To do that I needed a utility which will allow me to see and manipulate NTFS folders from DOS.

In case you are now thinking to write "Well, if this is all you wanted, why didn't you just say it?!" I apologize in advance once more for being too unclear.



Yes, like I said, NTFSDOS Professional helped. It allows just that: manipulating files on NTFS drives freely from DOS environment. BTW, it's scary how it completely seems to ignore administrative rights. Or maybe I haven't looked into it enough yet.



I know how to use DEL, RD, DELTREE and ATTRIB, thank you.



Irrelevant. Not the problem. Hope this time my above explanation was clear enough. If it wasn't, this time I'm not going to apologize.



When someone tells you he wants C:\WINDOWS gone, what pops to your mind?



Here's a shorter one:

ATTRIB -R -H -S DIR_I_WANT_TO_DELETE
CD DIR_I_WANT_TO_DELETE
ATTRIB -R -H -S *.* /S /D
CD ..
RD DIR_I_WANT_TO_DELETE /S




I hope that you know the answer to this already having read down to here.



Jesus fuck, man. Why reinventing the wheel? Create an NTFSDOS Professional floppy, boot from a DOS/Win9x floppy, launch NTFSPRO.EXE and type a few commands from the command prompt. Why build a batchfile even?

The more I talk, the more I think that it's not an issue of you misunderstanding my initial question, it's an issue of me and you having COMPLETELY DIFFERENT AND INCOMPATIBLE PATTERNS OF THOUGHTS. LOL. Or maybe we are both just too stubborn for our own good.

Have fun and thanks for wasting so much of your time on me. And I mean, wasting, yes, because the solution was ready before your first post in this topic took place.

EDIT: Having re-read my first post again... Yeah, you are completely right. It wasn't clear. I put in some irrelevant stuff and left out some relevant stuff. The problem is that I take some things for granted, while they aren't. Once again, my most sincere apologies.

I think I can now sum it up.

When you want to reinstall Windows FROM SCRATCH, you have two options basically. First one is indeed format the partition, but as I explained, sometimes it's a thing you don't want to do, because you may have lots of valuable stuff on that partition with no means or no will to back it up.

To have a clean install without formatting, you need to erase the exact directories that I mentioned in my first post.

You cannot delete them properly while Windows is running. Like I said, it's not an issue of administrative rights, but of files being protected by the run-time module. Your batchfiles won't do the trick here, because all they do is call the systems delete commands, which will not work, because of the above mentioned protection. You will simply run into many files which will give you the famous "Access is denied" message.

BTW, your comment on my suggested batchfile not having DEL or ERASE, look closer: RD /S in Win2K/XP = DELTREE in DOS/Win9x. That's why I said that your batchfiles are reinventing the wheel - there is a built-in deltree in 2K/XP. Not sure about NT, though, I don't think I ever used it.

Your next suggestion, the recovery console, was the first thing I tried. As you guess, it didn't work. It's funny that the RC allows you to run format on a partition, but doesn't allow you to run RD over a selected directory (Access is denied). So, unless there are some more complicated ways to get the RC to allow you to RD a direcory, it is not an option here too.

Hence, I was looking for a way to get a pure DOS environment with full access to any NTFS volumes. Since the NT OSes don't run over true DOS, they don't provide you with such tools. I couldn't find any 2K/XP bootdisk to allow me to do that either. That's when I ran into NTFSDOS Pro.

The great thing about NTFSDOS Pro is that it makes any NTFS partitions look like regular FAT/FAT32 partitions to the OS, allowing you to use any OS commands on these files in Win9x environment. BTW, apparently it won't work with DOS 6, as I originally thought (I tried it with Win98SE bootdisk).

You can find yourself in need to access the hard drive from pure DOS from various reasons. For example, just a few days ago I had a totally fatal WinXP crash (REGISTRY_ERROR 0x51). It wouldn't boot normally, it wouldn't boot in safe mode, it wouldn't boot to the recovery console, it wouldn't even boot ERD Commander 2003 (a full-featured Win-style recovery environment by Winternals, the same guys that made NTFSDOS).

This situation is pretty rare, but if it happens - you absolutely cannot access anything on the hard disk except from pure DOS. What do you do if you have some crucial files there and you need them?

If the partition is FAT32, you can use a regular Win9x bootdisk. If the partition is NTFS, you get the same result with Win9x bootdisk + NTFSDOS Pro.

Yeah, but if you want to always do current backups of everything, you'll end up doing nothing but running backups. So in the end, most people do selective backups of their important data every once in a while.



Yeah, you can. But there are also "Program Files" and "Documents and Settings" and the files in the root folder, and I don't want to trust Windows to be able to throw the old junk out itself, so I prefer to delete this junk myself prior to installing.



Are you blind?



Dunno, never tried. Don't care enough.



I'll ask again: are you blind?



What makes you say RD /S won't work on hidden/system/read-only files/directories, when it clearly does work? So, unless you count the verbose messages as an improvement, it's really nothing but reinventing the wheel.



Conclusion: RC is crap?



Unless you reach to the point where you start wasting more time on backing stuff up than on working.



First of all, not always. In the example I brought, nothing related to Windows would boot - not Windows, not Safe Mode, not RC, not installer, not third-party tool. That was truly a hideous crash.

Besides, what's simpler / more efficient: installing a second OS or launching NTFSDOS from a floppy?

Before you haven't said anything about %1 - %9, you said you couldn't see RD /S, when it's there. Make up your mind.

Then replace DIR_YOU_WANT_TO_DELETE with %1, if you want. I wasn't thinking batch files when I wrote it, as I would never write a batch file for something as simple as RD /S. In fact, as was discovered, everything can be replaced with a single call to the RD /S command.



For a task as simple as deleting a directory, 99% of the time it will be getting on your nerves rather then being useful.



It had nothing to do with the bootsector, I believe. The hard disk was just fine and so was the data. It would initiate the boot process, and then crash with the registry error. It wouldn't even let me get to the point where I could execute FIXMBR or anything.



Oh. Well, let me tell you how NTFSDOS Pro works:

1) You type NTFSPRO
2) You press enter

The simplicity is what bought me here.



No doubt there are, but I'm not convinced any of them will allow you 100% deletion of all system files and a fresh install, and if they do, it may become tedious, and definitely not worth my time. That's where NTFSDOS kicks in.

Hi dr_st,

You may also find this interesting:

http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html

It allows read-write access to NTFS for the purpose of registry editing and password resetting, but you could also use it to rename or delete previous Windows install directories.

(By the way, I don't think you have anything to apologise for in your initial post -- clearly AlecStaar did not comprehend the question correctly.)

It's ok, I know what was said as I already read the thread in its entirety.

Just to clarify the part of my post that you replied to -- the essence of his initial question was how to delete files that a running system always has open, and thus locked from deletion. He wasn't asking for general purpose deletion solutions, and therefore had no need to apologize for his initial question getting answers from you that didn't solve his problem.

Hope this clears up what I meant.

Yeah, I add my apologies into the mix as well, as I kind of caused the thread to get off-topic.

Not sure if Alec or anyone else for that matter mentioned this, but if you want a semi-GUI for the DELTREE (exclusively for removal of 'Program Files' and 'Windows/WINNT') you may want to look at Bart's PE Builder.

And again, I'm sorry, hopefully there's no hard feelings or anything. My only reason for posting at this site is to help others, and hopefully my semi-offtopic posts can someday be useful to another reader.

Cheers.

Ah, nice! Thank you.

Well, I never did assume there would only be one tool (NTFSDOS) that can do it. It's really a task that often needs to be done by administrators or plain "power users" such as myself.



No, he didn't. But that was in part because I didn't formulate it in the clearest way I could, so I will not try to dodge guilt here.



And the free read-only model is useless for my case, although for the sake of rescuing files to another HD it might be just right.



Wow! That is some work!



Again, to me and to you it was clear what I wanted, but re-reading that first post of mine I realized that indeed I left too many options to misinterpret it, thus I apologized.



It was the first thing that was offered (by Curley_Boy, see the beginning of thread). I actually tried it, but never did get it to install - it seemed to want an XP CD with SP1, and I didn't have one at the time. Too much trouble for the likes of me, so I ditched it. Now I have NTFSDOS if I just want to do what I started this thread for and ERD Commander 2003 if I want a graphical rescue environment.

It seems as though a solution has already been found. But here is another idea.
Try download a version of knoppix linux that has full nfts read/write support Kanotix. Just download the ISO, burn, and pop it in your CD drive (Its a live CD, there is no installation, it runs fully from the CD). You just boot up and it gives you a full linux graphical distrobution that has the ability to read and write to your ntfs drive. You can then delete the windows directory and leave the stuff you actually want.
Give it a try, I us Knoppix all the time while building systems, its much easier to do a full burn in test of all the components before putting windows on.

Originally posted by kref1:


Why, thank you too! I actually have a Knoppix CD. A friend, who's a Linux freak has insisted on giving it to me. I don't know if it has Kanotix, though. I must admit shamefully, that I feel much more comfortable with DOS than with Linux, though.

DR_ST, you may be interested in knowing that the Offline NT Password & Registry editor that was linked to above was just updated a few days ago, apparently fixing a bug that could happen when writing back to the NTFS partition.

So should you use it, I would recommend an upgrade. I just happened across that page a few days ago, and it's definately a great, great tool.

Cheers