Secure deletion details

Overwriting NTFS File Streams

A file on an NTFS drive can hold more than one stream of data. Windows Explorer shows only the main stream and its size, so hidden data in alternate streams is easy to miss. Advanced File Shredder overwrites every stream of a file, not just the one you see.

What is an alternate data stream?

NTFS, the standard file system on Windows, stores a file’s contents in a default unnamed data stream. A file can also carry any number of named alternate data streams (ADS), written as filename:streamname. Windows itself uses them: for example, files downloaded from the internet get a Zone.Identifier stream that records where they came from. Applications can use them to store any data at all.

Alternate streams do not change the size Explorer displays and are not shown in a normal directory listing. A tool that overwrites only the main contents of a file leaves the data in its other streams on the disk.

Try it yourself

Open a Command Prompt in a folder of your own, for example your Documents folder, and run:

Explorer now shows a single file, myfile.txt, with the contents “my data”. The word “password” is stored in the hidden stream secret. To see it:

dir /r lists the file’s alternate streams, and the second command prints the hidden text. In PowerShell, Get-Item myfile.txt -Stream * lists them too.

How Advanced File Shredder handles streams

• Finds every data stream of each file before shredding it.
• Overwrites each stream with the selected method – strong random data, US DoD 5220.22-M or Gutmann’s method.
• Verifies the overwrite by reading the last pass back from the disk.
• Overwrites the file’s cluster tail, then renames the file and resets its time stamps before deleting it.