Need That File Really and Truly Gone? Try BCWipe

BCWipe 5.0 is a suite of tools and utilities that help provide security by making sure that deleted files are truly gone. It’s generally well-known that “deleting” a file in Windows doesn’t truly erase it; what’s less well known is how easy it is to recover files, or partial files, even after the Recycle Bin has been emptied and it seems the file is gone for good. BCWipe ($40, 25-day free trial with limitations) works by overwriting the space formerly occupied by a file with various schema of random data, as per the user’s desire.

This is one of BCWipe’s strengths. It includes a large number of wiping protocols, and allows the user to define their own, mixing and matching random and cyclic data over a user-defined series of passes. The reason for this is that it is considered possible for a determined attacker with access to a physical hard disk to read magnetic “echoes” of existing data; information wiped only once may be susceptible to recovery, and there are many different protocols which have evolved to help insure this is impossible. (As with all things in the field of computers, this is an area subject to much controversy and debate; some experts feel more modern drives, with very high information densities, are virtually immune to such recovery and a single pass of random data is good enough.) Whatever your personal preference or corporate mandate, you ought to be able to find or create the correct protocol to meet it.

BCWipe 5.0 also includes a powerful, but easy-to-use, scheduling tool, allowing you to schedule wipes of specific files or folders, at desired times, once or on a schedule, and to set all the options possible for each task. Wiping of free space is one important task, as it will overwrite areas marked as “empty”, which may contain data which was not wiped securely. Windows constantly creates and erases temporary files, so even if you deleted “1stQuarterBudget.xls” with wiping, a temp file containing much of the data may still lurk undetected on your hard disk, even though Windows deleted it.

This is an area where BCWipe 5.0 offers a very useful feature: transparent wiping. This feature intercepts all OS level calls to delete files, including the myriad temporary files created and destroyed during system operation (and a look at BCWipe’s log, with this feature active, will show you how many there are), and then wipes them. For the sake of speed, the default is to use a single random pass, but this can be changed. Further, specific folders and/or file types can be excluded, which may be desirable for some auditing or backup purposes. Speed is, as expected, fairly linear with passes and the actions taken in each pass. Wiping a 1 gig file with a single pass took 43 seconds for me, and wiping a copy of the same file using the DOD 5220 method, which had three passes and did more on each pass, took 181 seconds.

Even if you use full-disk encryption (as I do), a program like BCWipe can be useful when dealing with the threat of someone connecting to your computer while it is running, or otherwise gaining access to unencrypted data.

BCWipe’s only significant flaw is that the interface can be a little confusing. There are several separate tools–the scheduler and the transparent wipe utility–which can be launched from a third tool, the main executable. When you initially create a scheduled task, the default time for creation is “right now,” which means, if you don’t change it, when you save the task to the scheduler, it will be marked as “time has already passed.”

If you must uninstall and reinstall BCWipe, do so with caution. I experienced several issues getting BCWipe 5 to correctly install due to the remnants of an older version that had been partially removed and left invalid registry entries after several disk swaps and remappings; these are issues most users will not contend with. To their credit, Jetico was generally quick to respond and to provide step-by-step directions to deal with the issues that arose.

BCWipe’s trial lasts for 25 days, and only permits one-pass random wiping. This allows you to test the scheduler and other options, and get a feel for BCWipe’s suitability for your security needs.

–Ian Harac