An easier 'Secure Delete' option

[Unknown_User_486]

So I assume deleting the top-most Sandbox folder will not harm anything?

[SBIE User]

So I assume deleting the top-most Sandbox folder will not harm anything?

Correct. It will just be re-created the next time SandboxIE is invoked.

I always erase it.

SBIE (Happy) User

[Unknown_User_486]

OK. Moved top-level folder from %AppData% to my "My Documents" folder, and SDelete wiped it all away. For some reason, Windows Washer still will not work. But I'm happy using SDelete.

Thanks again, SBIE user.

[SBIE User]

Great.

SDelete is handy because it is Windows-based and can handle long file names. However, as I mentioned somewhere above, it does not actually securely erase filenames -- which can still be recovered. If you want more security, you can user Eraser -- but SDelete is really strong enough.

SBIE (Happy) User

[SBIE User]

By the way, if any of you want the SDelete batch file to check to make sure the sandbox has been removed, you can add the following lines (corrected for the path of your sandbox directory and name) to the batch file immediately before the pause statement:

echo.
if exist f:\sbox echo *** WARNING Sandbox not erased fully. ***&pause
if not exist f:\sbox echo Sandbox erased successfully.
echo.

SBIE (Happy) User

[Unknown_User_486]

Now, that is SWEET. THanks again!!

[Unknown_User_475]

I think the post here is the best and ultimate solution.

Much better than messing around with indirection solutions like batch files or worse, needing to run a seperate app like ccleaner with the whole gui loading..

Also as mentioned eraser is way better than sdelete since it makes file names unrecoverable too.

[Unknown_User_475]

Since this question comes up periodically, I want to add another observation on a very important factor related to the frequent suggestion to add native code in SandboxIE to perform secure erasing.

If one is concerned about security to the point of using a secure erasing program, then she or he would almost surely want to have the integrity and effectiveness of the program verified by the security community. That is standard practice for encryption and secure erasing programs, and most security experts recommend against using "proprietary" or "closed source" encryption or secure erasing code which cannot be reviewed by the security community.

If Tzuk were to add secure erasing code natively in SandboxIE, he would either have to open up his code for review or would have to endure suspicions that his code was not safe or effective. He can't include public domain code (that has already been reviewed by the security community) in his program without changing the license of his own code.

So, what alternatives does Tzuk have? First, he could just ignore this issue and let folks handle secure erasing on their own using free software outside of SandboxIE. (That was his strategy until fairly recently, and it worked fine.) Second, he could provide a means to link from SandboxIE to third party programs (free or commercial) that have already been accepted and tested as effective and safe. That is his current strategy, and it goes as far as he can go without focusing on writing new, proprietary secure erasing code and then either opening up his code or suffering the suspicions of others.

While I understand that people would like to just have a push-button or check-box solution to secure erasing, that is not easily or reasonably doable in this case.

I hope that adds some perspective to this continuing discussion.

SBIE (Happy) User

I agree 100%.

I suppose to make things easy for beginners, some of you guys could host additional addon packs that will include eraserl or whatever reputable free and/or open source secure deletion tools and drop it into the right place plus importing the registry key with the correct settings.
Some simple installer could do it.

I think licensing issues would preclude adding eraser has an official part of sandboxie though so it has to be a third party thing.

[Unknown_User_486]

Also as mentioned eraser is way better than sdelete since it makes file names unrecoverable too.

Hello, Herbalist

I can see why it's better to delete a filename as opposed to leaving it intact, but according to SDelete documentation (http://www.sysinternals.com/Utilities/SDelete.html), it renames the file 26 times. So, can a file name really be recovered after all this?

[SBIE User]

Daisy,

Because SDelete does not make filenames unrecoverable, the length of the filenames can be recovered. Also, because the pattern of renaming is known, it might be possible to recover the names themselves -- but that does not seem likely. I think SDelete provides very good security.

If you want to use Eraser you can either user eraserl.exe or eraserd.exe, both of which claim, I believe, to make filenames unrecoverable. Both are installed as part of Eraser 5.8, which is available from http://www.heidi.ie/eraser/download.php .

Below is some batchfile code to execute eraserd.exe (the DOS version of Eraser) in erasing a sandbox with a user-input number of passes. Of course, I make no guarantee or claim that files or folders erased using this will be undetectable or unrecoverable. Windows is inherently insecure and leaves lots of traces of activity.

Note also, that you will need to change the code for the location of Eraser if you don't use the default installation folder and also for the name of your top-level sandbox (the code assumes it is c:\sbox).

@echo off
:: Program name is ERASBOX.BAT.
:: ERASBOX.BAT uses eraserd.exe to erase a sandbox with a user-input
:: number of overwrite passes.
:: CAUTION: There is no guarantee or claim, expressed or implied, that erased
:: files cannot be detected or recovered after using this batch file.
:: Eraser 5.8 (with eraserd.exe) is at http://www.heidi.ie/eraser/download.php .
:: The code below assumes that the top-level SandboxIE folder is c:\sbox and that
:: Eraser 5.8 has been installed in default directory at c:\Program Files\Eraser.
:: Some of the code below may need to be modified to indicate a different path
:: to the eraserd.exe program or different top-level sandbox location and name.
:: IMPORTANT: Top-level sandbox directory and name cannot be longer than 7
:: characters and must not contain any embedded spaces. Use C:\SBOX or similiar.
:: See boxed comments in code below for lines that may need changes.

cls
echo.
echo This will erase/overwrite the sandbox and all subfolders . . .
echo --------------------------------------------------------------
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Next line sets default number of passes. This may be changed as needed. ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
set wipes=3
echo.
echo.
echo Enter the number of erasure passes desired
echo (or enter 0 to quit or press Enter for 3)
echo.
set /p wipes= ?
if %wipes%==0 goto CHECK4BOX

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Change eraserd.exe directory and sandbox location below if sandbox is not ::
:: in c:\sbox or eraserd is not in default directory. ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
"c:\Program Files\Eraser\eraserd.exe" -folder c:\sbox -subfolders -passes %wipes%
echo.
echo.
echo.

:CHECK4BOX
set pword=passes
if %wipes%==1 set pword=pass
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Change sandbox dir/name in the next 2 lines if different from c:\sbox ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
if exist c:\sbox echo *** WARNING -- SANDBOX NOT FULLY ERASED. ***&goto END
if not exist c:\sbox echo *** Sandbox erased with %wipes% %pword%. ***

:END
echo.
echo.
echo Press any key to close this window . . .
echo.
pause > nul
exit

This works for me, but I make no guarantees for others. Use only at your own risk.

SBIE (Happy) User

[Unknown_User_486]

Daisy,

I think SDelete provides very good security.

SBIE User, thanks. I tend to agree with your statement above. And since I already have the batch file up and running correctly for SDelete, I'm going to stick with it.

By the way, I normally use Cryptosuite (http://www.ghostsecurity.com/cryptosuite/) for my encryption and file/folder deletion needs. Unfortunately, it apparently does not offer a command line option (yet).

[Unknown_User_461]

Thanks, SBIE User. :D

I've given up on WindowsWasher for this. Folders were still locked even now as I try to delete them manually.

I tried your batch file, and it worked pretty well. It apparently deleted all of the FILES beneath Sandobox folder, but it did not delete the sub folders themselves. Received error message saying folders were not empty (it contains sub-folders).

You need to add the -q switch

Code: Select all

c:\SDelete\sdelete.exe -p 3 -s -q "C:\Documents and Settings\Owner\Application Data\Sandbox"

I don't know why that is, it might be a bug, but it seemed to help in my case.

Also another thing to watch for is that files names can get too long for windows to delete, you may have to move your sandbox to another path like c:\sbox

[SBIE User]

You need to add the -q switch

Code: Select all

c:\SDelete\sdelete.exe -p 3 -s -q "C:\Documents and Settings\Owner\Application Data\Sandbox"

I don't know why that is, it might be a bug, but it seemed to help in my case.

I don't think that's not a good idea.

The-q switch (for "quite" mode) only forces the program to not report errors, so you won't know it didn't work. I'd rather have the error report when anything goes wrong.

Actually, several of us have gotten SDelete to work fine with the code I provided, so the code works. However, Daisy did report that she could not get it to work with her application folder and had to move her top-level sandbox to another folder. That might be a long file name/long directory name problem, as you suggest. If so, add the -q switch would not help.

I have posted a batch file for using eraserd (the DOS version) of Eraser 5.8 above, but it is definitely limited to top-level sandbox folders with short names.

If anyone wants it, I will post a batch file using eraserl (the Windows version) of Eraser 5.8, which does not have problems with the length of file or directory names. It's a little long, so I won't post that code unless someone specifically requests it.

SBIE (Happy) User

[JustPassingThrough]

Using the "Custom Wash Item" function in Window Washer will most likely fail, but there IS a trick that WILL work. Use the earlier supplied registry info for "DeleteCommand" and set the value as the following (assuming it's the default install path on drive C:\, of course):

Code: Select all

"C:\Program Files\Webroot\Washer\wwshred.exe" "%SANDBOX%"

This will open the dialog confirmation box alerting you that you're about to shred everything in your sandbox (as if you right clicked and chose to shred it manually).

It isn't a perfect solution (it will shred the files/folders/subfolders in the Sandbox folder, but not the Sandbox folder itself) but I'm guessing it can be tweaked to fully shred the entire Sandbox folder if you replace %SANDBOX% with the hard coded path to your Top-Level folder.

Anyways, just throwing that out there. Oh, and might I add that I LOVE Sandboxie, brilliant program.

[JustPassingThrough]

Er, or not. I just tried hard-coding the path to my sandbox folder to see if it would indeed shred everything, but alas...no luck.

Oh well, I'm fairly satisfied with just using %SANDBOX% -- empty folders don't bother me as long as I know everything inside of them were securely shredded into oblivion.

Can't for the life of me figure out why hard-coding the path to the folder didn't work, though. Oh well, cheers!