Ask Leo: How much of my search history could be recovered?

askleo

By Leo Notenboom

Hey Leo, Just wondering. The recent trial in Florida where the DA searched the
plaintiff’s computer and found an incriminating internet search for formaldehyde
leads me to ask two questions. I mainly use CCleaner after using the net to clear
cookies, but it also clears history and other stuff. Does CCleaner or even manually erasing history actually remove the history from the hard drive? Is every bloody key stroke permanently kept on the HD? And if so, where? Nothing to hide. Just curious.

Unless you have spyware installed on your computer, “every bloody
keystroke” is not being recorded. I get that question often enough that it seems like many
people are concerned about it – it’s just not the case.

As for finding other things and seeing what CCleaner or other tools might or
might not erase – well, things get complicated pretty quick.

Does removing history remove history?

Yes and no.

The problem here is that there are several “levels” of delete and many
can be recovered, depending on the level and the amount of effort (and perhaps money) that you’re willing to throw at the problem.

“… the possibilities are at least worth knowing about, even
if you truly have nothing to hide.”
  • A file deleted to the Recycle Bin can be recovered from that very simply, but I don’t believe history is deleted to the Recycle Bin.

  • The space used by a file that was deleted “permanently” is simply marked as now
    being free. That means that until it’s overwritten by other data, the original
    data actually remains on the disk and can possibly be recovered with special
    tools.

  • Data on magnetic media that has been overwritten once or twice
    might (and I have to stress might) still be recoverable by some fairly
    advanced magnetic media analysis.

  • Data that has been overwritten multiple times can typically not be
    recovered.

So, if a history file was deleted, there’s a chance that it could still be recovered, depending on a) how much the computer has been used since the delete, and whether or not data has overwritten the space that was previously occupied by the history file, and b) how much effort you’re willing to put into the recovery.

I have no idea if a history file was used in the case that you mention, but my guess is that law enforcement was motivated to put in a lot of effort into the process.

Article Continued Here: Really removing traces of data

This post is excerpted with Leo’s permission from his blog.

FaceBook URL: Leo’s Facebook

Twitter URL: http://twitter.com/askleo

(Visited 12 times, 1 visits today)

2 thoughts on “Ask Leo: How much of my search history could be recovered?

  1. I have for years made a point of defragmenting my drive after running Cleanup. My assumption is that a lot of file space will be moved and overwritten, so that any old files and fragments will be completely destroyed. Is this not the case?

Leave a Reply

Your email address will not be published. Required fields are marked *