Privacy.. I forgot name of "file" that does not get wiped.

[oxgt2e]

Hi guys. A conversation came up last night among my friends regarding Windows 7 (and Vista) and cleaning for security and privacy. There was a general consensus among the group that CCleaner (with CCenchancer) cleans everything. During this conversation I was reminded about some kind of "file" that does not get wiped by normal means. I remember reading that one would have to run a command window in order to properly wipe or reset this file -- that cleaners did not clean it nor did rebooting the pc reset the contents of this file. The way I remember it (although I had a poor understanding of it) this "file" was inherent in Windows and "recorded" browsing activity, program activity, and other things. I remember that it is something that can't be disabled, and so the best you could do was to "reset" its contents via command prompt window. It seemed to me like a pagefile type of thing, but it wasn't the pagefile and it wasn't hiberfile because those could be disabled. It wasn't index.dat either because it was something that cleaners didn't clean. I remember reading about this file on a Windows security website many years ago. The article was about law enforcement techniques and that they use this file because most people are too comfortable with ordinary cleaners and most people aren't aware of this file either. I wish I could remember more about it. The command to wipe this file was a very short command too. I'm searching all morning for any information and its driving me crazy because I am coming up empty. Any help would be appreciated.

 

[boohbah]

its possible its an index.dat file,

Delete index.dat files

 

[Corazon]

It might be the USN journal. It can be deleted with fsutil usn deletejournal /n X: but if you do this on the Windows system partition, it will immediately be recreated.

 

[whs]

Maybe you were thinking about the shadowstorage. The command to delete is vssadmin delete shadows

 

[pincushion]

There is a lot of information in $Logfile but it certainly doesn't record everything and although I haven't searched it cannot be deleted as far as I know. The single index.dat file that seems to hold most items is zeroed by CCleaner.

 

[A Guy]

You say "It wasn't index.dat either because it was something that cleaners didn't clean". But it sure does sound like index.dat you are describing. Which CCleaner will delete BTW. You can also delete them manually:

Boot to Safe Mode With Command Prompt in an administrator account. In the command prompt type:

CD\

Enter

Type

del index.dat/s

Enter

Type

shutdown -r

Enter

The PC will restart

A Guy

 

[pincushion]

You say "It wasn't index.dat either because it was something that cleaners didn't clean". But it sure does sound like index.dat you are describing. Which CCleaner will delete BTW. You can also delete them manually:

Boot to Safe Mode With Command Prompt in an administrator account. In the command prompt type:

CD\

Enter

Type

del index.dat/s

Enter

Type

shutdown -r

Enter

The PC will restart

A Guy

As I said the single instance of index.dat that seems to contain all the sensitive information is overwritten by zero's by CCleaner and not deleted, mine is about 8 MB. All the other instances of index.dat don't seem to contain anything or are deleted/erased. :huh: