Thread: How to delete a folder(not files inside) permanently?

How can we wipe a folder permanently?For files I overwrite the file's contents using "85" as a char value, so it overwrites files with 01010101 bits.But I don't understand how I can overwrite folders' information/folders' names to permanently wipe the folders' names/information.Do folders have any contents other than files inside of them?How can I delete folders' names/information permanently(in a non-recoverable way) using standard C++(or C++ builder)? I use Windows 7.

There are programs out there to do this already, but if you want to do it yourself, you'd just rename the files with your chosen pattern, to overwrite the existing name, and then delete them. I recommend doing this repeatedly, with changing patterns, because just overwriting with a single pattern is insufficient to make data unrecoverable. I believe the DOD standard is something like 35 times, and with a specific set of patterns.

I think you've got your work cut out if you're using NTFS (you did mention Win7, and you didn't mention you were targeting a different filesystem).

Here's a bunch of links to read.
NTFS File Types - Data Recovery Concept
NTFS Directories and Files
NTFS Basics
NTFS - Wikipedia, the free encyclopedia
https://support.microsoft.com/en-us/kb/100108
https://technet.microsoft.com/en-us/...(v=ws.10).aspx
http://forensicmethods.com/ntfs-index-attribute

Here are some problems that you might face:
- That the filesystem is multitasking, so you can't target the disk at a low level without risking the target sector being re-used asynchronously.
- The filesystem may have a journal file containing x amount of history; this may (just guessing) be a cyclic buffer, so who knows how far back in time there may be evidence.
- The filesystem has swap file and hibernation files, containing who knows what.
- The filesystem has a large amount of metadata scattered in several places. Some of this is adjusted on the fly, which means there may be multiple fragmented old copies of bits of information.

In addition to all of those issues, you simply won't have the API's available to manipulate all of those hidden places.

If the underlying hardware is rotating memory, the sector your directory is in could suddenly fail and be remapped elsewhere. Forensically, the bad sector is probably recoverable.

SSD disks work on different principles, where each write to disk happens at a different place (at the hardware level). Only when an erase block contains only deleted data is it actually erased.

Here is sysinternal's own attempt, with lots of disclaimers.
https://technet.microsoft.com/en-us/...s/sdelete.aspx