Wiping Selected Files From a Hard Drive

I had a recent case where I needed to wipe files belonging to a client from an ex-employees computer. The files were identified by keyword and all hits were to be wiped from the computer.

I initially thought that one of the Windows Eraser programs would be able to take a list of files as an input file from a text file and then wipe all listed files. I was surprised to find that I could not  do this with the usual Windows wiping programs that I was familiar with.

In the end I decided to use a batch file to automate deletion of the files and then use Eraser to wipe the free space of the hard drive to wipe all the deleted content. The delete then wipe process was more at the request of the client for a consistent approach to other aspects of the engagement.

The batch file uses a text file called “filelist.txt” as an input file and then uses the delete command to delete the files.

The batch file consists of the following commands;

@echo off & setLocal EnableDELAYedeXpansion
for /f "tokens=* delims= " %%a in (filelist.txt) do (
if exist "%%a" del "%%a"
)

As shown below the batch file can be converted to wipe by replacing the “de'l” command with “sdelete.exe” (available from Sysinternals package at Sdelete Download).

@echo off & setLocal EnableDELAYedeXpansion
for /f "tokens=* delims= " %%a in (filelist.txt) do (
if exist "%%a" sdelete.exe –p1 "%%a"
)

I had issues with the file list being recognized correctly as the input lines of the full path seemed to error on the carriage returns/line feeds and spaces in the file path. Using the above batch file I was able to get the file paths to be recognized correctly if they were surrounded by double quotes “”.

I exported the identified files from EnCase table view using the full path column and then imported the list into Excel into column A. Then using the formula =""""""&A1&"""""" I was able to create the double quoted file list in column B. I then copied the column B contents to a text file called “filelist.txt”.

I also managed to do the same process in Linux (with a lot of help from echosix), and I will write this up at a later date.