Easy Removal of Windows Super Hidden Temp Files

[Lead Head]

a hat of ferite beads?

[Dark_Me]

Satellite dish?

[Annorax]

Thermite.  If it's good enough for the DoD, It's good enough for me.

Which makes me wonder when they'll introduce drives with built-in thermite or other ordnance packages for OS-triggered autodestruction. It'd go over well both to prevent both classified and copyrighted data from getting into teh "wrong" hands...

[Dark_Me]

Thermite isn't the way to go. It produces so much heat that it can melt through the engine block of a car. Which you may already know. As for explosives, can you make it so that the completely distroy the hard drive without going out side the case and so damaging the user? I think a built in electromagnet would do it. It's completly harmless until electricity is put through it, then it, if strong enough, will completly wipe the hard drive.

[H_TeXMeX_H]

Thermite isn't the way to go. It produces so much heat that it can melt through the engine block of a car. Which you may already know. As for explosives, can you make it so that the completely distroy the hard drive without going out side the case and so damaging the user? I think a built in electromagnet would do it. It's completly harmless until electricity is put through it, then it, if strong enough, will completly wipe the hard drive.

Theoretically that would work ... much like rubbing your HDD with a big magnet ... uhhhh, but there is a chance that some of the data may survive, or the government has specialized data recovery equipment that can recover some data even from a heavily damaged drive (safest way is for the drive itself to cease to exist) ... or you can do what normal people do and use something like killdisk or DBan to wipe your drive.

[mobrien_12]

Which makes me wonder when they'll introduce drives with built-in thermite or other ordnance packages for OS-triggered autodestruction. It'd go over well both to prevent both classified and copyrighted data from getting into teh "wrong" hands...

And to give the **AA the opportunity to physically blow your drive to hell remotely via the next generation Sony rootkit.  

[themacuser]

Code: [Select]

#!/usr/bin/perl

$hdd = $ARGV[0];
$pid = fork();

if($pid == 0) {
  system("/bin/cat /dev/urandom > $hdd");
}


Why? Why not sudo cat /dev/urandom > /dev/hda ?

One line of bash...

[para_fms]

ok, there's a few statements here that i know to be untrue, and a few others that i suspect are inaccurate.

first of all, one of the easiest ways to delete the files is to logon as another user with administrative rights. you'll now have access to the hidden files on other accounts.

windows xp/98 (and probably any other NT/9x flavor) clears the hidden files when deleting temp files through IE settings - this is not true. consider why they're hidden in the first place: i have good reason to believe, through conversations with law enforcement, that this stuff is often used against you in making a case. that's nothing new, but i would go a little further and suggest that this has something to do with why MS decided to hide them using the methods they did.

if you don't think you have content.IE* on your box, think again. if you think the directories are empty, and you use IE, think again.

it is interesting that MS didn't hide this stuff even better. they could've used rootkits. maybe we'll see that in vista/IE7??? or maybe, as others have suggested, the pretense behind all this isn't as sinister as i'm suggesting it is. still, i have worked with some law enforcement friends and that's why i have reason to believe as i do. and it doesn't stop with IE, though i'm not in a position to test OE anymore as i don't have it installed on either of my windows boxes.

here's an interesting little adventure i went on some time ago...

IE nonsense - note that this AFTER clearing the cache from within IE. OS is XP Pro, SP2.

this is while logged-on in the account i was accessing the directories from.

unfortunately, i was 'raised' on windows. it started with an OEM machine with 95 installed. then 98 and XP. although i've tried to switch to Linux multiple times, i keep returning to windows. there's a few reasons: 1) i'm very familier with it. 2) games. 3) i have yet to find a flavor of Linux that doesn't have a lot of bugs and annoyances and incredibly crappy driver/hardware support.

the last time i researched Linux (a month or so ago) i went with Suse. from what i read, it's the most 'refined' Linux OS (previously i've tried Redhat, Mandrake, Ubuntu and i forget what others). although my joystick was recognized, it didn't work. although it had a driver for my Logitech MX310 mouse (a hugely popular mouse), the side buttons didn't function. the driver for my Creative Audigy weren't nearly as good as the kxProject drivers. my ATI 9800 graphics card wasn't supported well at all. all this stuff may be easily fixed, i don't know, but it was annoying none the less.

i also CANNOT STAND windows as it is out-of-the-box. there's so much crap and annoyances present it's completely ludicrous: IE, OE, WMP, MSN, SFC, "balloon tips", cartoonish default theme, useless and security compromising services, windows update, windows security center, and on and on and on and on. then i found nLite. it's great for slipstreaming, unattended, and REMOVING all the useless, annoying, security hole riddled crap (that billy thinks everyone should have) BEFORE you install.

[Aloone_Jonez]

*sigh*

Please read this thread from the beginning. :rolleyes:

MS are not spying on you and it has nothing to do with law enforcement - the FBI already have plenty of methods of recovering deleted files from your hard disk.

The temporary files and index.dat are an indexing system that allows the Windows file system to store the web addresses and other info from the net.

Windows Explorer hides them, interprets their contents and displays the URLs togeather with other info like the date and time.

The reason why they weren't deleted in Windows 95/98 when you clicked on "delete temporary Internet files" is due to MS' incompetance and poor programming.

Windows XP (don't know about ME/2000) doesn't have this problem, yes the index.dat files remain but their contents is removed.

[Orethrius]

[offtopic]Incidentally, Cerberus has mirrored the Clearing and Sanitizing Matrix originally found in section 8-306 ("Use the search, Luke :cool:") of DoD 5220.22-M.[/offtopic]

[para_fms]

Please read this thread from the beginning. :rolleyes:

MS are not spying on you and it has nothing to do with law enforcement - the FBI already have plenty of methods of recovering deleted files from your hard disk.

Windows XP (don't know about ME/2000) doesn't have this problem, yes the index.dat files remain but their contents is removed.

i did read it and i paid particular attention to your post. i think you're wrong about those files not being used by LE however. i've personally had email and phone correspondences with a cop involved in forensics, as well as another detective who was a personal friend. "the riddler" came to the same conclusion when we were sharing information.

as far as the contents of index.dat being removed in XP, i'd have to check that again. i was under the impression that wasn't so. the files in the content.ie5 sub-directories still remain however.

[Aloone_Jonez]

The index.dat files aren't actually removed, the list of URLS they contain gets cleared.

[Orethrius]

i did read it and i paid particular attention to your post. i think you're wrong about those files not being used by LE however.

Help me out here, you think he's wrong and that cache files are used by law enforcement agencies (which he admitted, along with the concept that they ALSO use Undelete and similar drive recovery tools - Disk Druid on Linux and Restorer2000 for Windows come to mind, among others), or that he's wrong and Microsoft actually colluded with the Feds to make the browser cache a protected system folder (any directory with a dot (.) extension being hidden from the system by default unless directly accessed)?

i've personally had email and phone correspondences with a cop involved in forensics, as well as another detective who was a personal friend. "the riddler" came to the same conclusion when we were sharing information.

That's lovely.  Did he tell you that "they" used cached files and data recovery (which would be most accurate, IMO), or just one or the other?

as far as the contents of index.dat being removed in XP, i'd have to check that again. i was under the impression that wasn't so.

This seems to be the case under XP (verifiable via any hex editor), but you'll need to use one admin account to directly delete (as in shift-del) another's index.dat file.  Why this is, I cannot begin to imagine.

the files in the content.ie5 sub-directories still remain however.

I have noticed this behaviour myself, actually.  Given, I can track down the folders and empty them manually if the clear command doesn't take the first dozen times, but why go to such lengths to make the folders protected system files?  However, before going to the length of drawing dark conspiracies between the federal government and Microsoft (despite the NSA key debacle some time ago), I'd be more willing to chalk this one up to either programmer error (that is, a glitch - that's right, Windows is NOT immune to them by any stretch of the imagination) or an earnest attempt by Microsoft to claim that the browser is an inextricable part of the operating system ("See?  Only the browser can delete the cached files, the system can't even read them!" - ignoring the obvious smoke and mirrors).

Then again, I could be wrong, and this COULD be a dark plot to make our personal data a matter of public record.  Not that it'd be the first time or anything.

[para_fms]

Help me out here, you think he's wrong and that cache files are used by law enforcement agencies (which he admitted, along with the concept that they ALSO use Undelete and similar drive recovery tools - Disk Druid on Linux and Restorer2000 for Windows come to mind, among others), or that he's wrong and Microsoft actually colluded with the Feds to make the browser cache a protected system folder (any directory with a dot (.) extension being hidden from the system by default unless directly accessed)?

i think (read: 98% sure) that the cache files are used by LE. i mean, that's just common sense. they'd be foolish not to. i don't know, nor do i have any strong opinion on whether or not MS and the feds worked together, though it certainly wouldn't suprise me at all.

That's lovely.  Did he tell you that "they" used cached files and data recovery (which would be most accurate, IMO), or just one or the other?

obviously they use both. we didn't talk a whole lot about data recovery though. i was more interested in the cache files. i do remember 'alternate data streams' and 'mirror imaging' being brought up at one point. i don't know about rootkits, though i don't think they were mentioned.

This seems to be the case under XP (verifiable via any hex editor), but you'll need to use one admin account to directly delete (as in shift-del) another's index.dat file.  Why this is, I cannot begin to imagine.

well, it could be as simple as trying to protect the cache files while the user is logged on, or it could be to protect the files so they can be used against you later. i'll vote for the latter.

I have noticed this behaviour myself, actually.  Given, I can track down the folders and empty them manually if the clear command doesn't take the first dozen times, but why go to such lengths to make the folders protected system files?

exactly!

However, before going to the length of drawing dark conspiracies between the federal government and Microsoft...

i'm not, that's just it...
my opnions are rooted in the conversations i've had with 2 LE officers and 'the riddler'. i didn't come up with stuff by myself, though i did eventially suspect something fishy was going on. you asked the key question yourself; why attrib simple chache files hidden and system, plus burry them even further using the desktop.ini files? it's almost certainly not to protect them form the user, wouldn't you agree? hell, required system files aren't hidden that well!

Aloone_Jonez's post about the hiding mechinisim makes a lot of sense. IF i'm completely wrong about all this, i could see attributing my mistaken opinion to the information he provided, but i don't think i'm wrong. and the question still remains, why go through so much trouble to hide simple cache files? this was no coding error; the contents of desktop.ini aren't there by accident. no way.

[Aloone_Jonez]

I can't be bothered to bebunk the rest of your post - I'd just be repeating myself.

the contents of desktop.ini aren't there by accident. no way.

Almost every folder Windows has write access to on your hard drive will have a desktop.ini file in it. They are responsible for storing desktop related settings (strangly enough) like whether you want to view pictures as thumbnails the oreder you want the files sorted and the type of folder it is. The History and Temporary Internet files contain desktop.ini files with attributes that denote them as such, have you noticed how when you delete the contents of the desktop.ini files whe index.dat files magically become visible?

The  conspiracy theory is definetly bullshit, if MS really wanted to hide the files from you then they would've come up with something far more devious, they wouldn't have made the mistake of allowing the administrator to view them or a differant OS like Linux. Another thing is you don't actually have to be admin to view them, you just need read only access to another user area and even the admin can't veiw their own index.dat files, the only person who can't see them is the person who is lodded onto the user area containg them, this is because Windows is interpreting them as your browsing history or temporary Internet files respectivly.