How do you delete files in Win2000?

[Mini-Me]

This sounds like an open-and-shut and OBVIOUS question, but bear with me...

Some details:

- Win2000 Pro.
- FAT32 filesystem.
- NO PASSWORDS - machine boots DIRECTLY to the desktop.
- Toshiba Satellite laptop.
- The client bought it in to me, as he could not delete certain files.
- The files are JPG images.
- The client added the files himself, from a USB flash-drive, back in February this year.
- 16 files, totalling 1.8MB.

The files are porn images, and he wants to make sure they are deleted, before he sells the laptop - fair enough.

In explorer, you can see the filenames, and the filesizes of the JPG images, but if you try to delete any one image, or the whole folder, Win2000 reports "Cannot delete - file cannot be found."
Double-clicking the filename results in the same message - "File not found.", even though you can see them there, and the filesize is listed.


Hmmmmmmm.

I ran CHKDSK /F, but this reported there were no problems.

I tried to delete by booting from a FAT32 Win98SE boot disk, navigating in DOS mode to the folder, and delete the files, but the DOS command prompt reported: "Access denied."

Oh great - very helpful - thanks a-lot...
:mad:

So next, I booted up from a Knoppix CD.

This allows me access via the Linux filemanager to the files I want to delete, and interestingly, you can actually view them under Linux, whereas under Win2000, it simply says they can't be found - wierd...

If I select any one file, or the whole folder under Knoppix, and try to delete, Knoppix reports: "Cannot delete file."

Very useful - why not?!??!???!!!!(rhetorical!)

If I ask for properties of any one file, or the folder containing the files, Knoppix reports that there are no restrictions, and anyone can edit, delete or read and write the files, so in theory YOU SHOULD BE ABLE TO DELETE THEM.

At this point, I am kinda stumped - anyone else here have any other ideas?

[PrntRhd]

ERASER program can erase individual files, but the most effective route is to use DBAN program and wipe the drive, then restore the original image assuming he has working restore disks.
http://www.heidi.ie/node/6
http://dban.sourceforge.net/

[Paul Komski]

An old post with a similar problem.

http://www.pcguide.com/vb/showthread.php?t=19364

There will be ways of deleting the files but porn or warez from a pen drive could have installed all sorts and wiping the drive would definitely be recommended prior to selling the PC. DBAN, as recommended, is good as is CopyWipe (http://www.terabyteunlimited.com/copywipe.php).

[mjc]

Often files of such 'character' contain 'illegal' characters in the filename making them 'delete proof' by normal methods. The best way to deal with them, especially if the machine is going to be sold is, like Paul mentioned, a total wipe...

[Fruss Tray Ted]

What about the possibility of Safe Mode?

Where are these files? Desktop? In a folder on the Desktop?

There was a time (98SE) when I had some files refuse to delete from the Desktop itself. I went to C:/Windows/Desktop (the folder) and deleted from there successfully. But I needed to make a new folder there, drag-and-drop the files into it and then delete the entire folder.

[Mini-Me]

Yeah, I hear what you all are saying.

I MANAGED TO DELETE THE FILES!

While I used a Win98SE boot disk, and it reported "Access Denied", I tried a very old Win95B boot disk - does not even have native DOS-MODE CD-ROM support, and navigated to the files, and issued DEL *.*, and they were gone. Next a few cd.. commands, and a rd other, and the folder was gone too.

Not sure why 98SE boot disk's command.com would not delete them, but the old Win95B command.com did not even ask - it just deleted them when I asked it to.

Anyhow, I would prefer to flatten the computer myself if it were me, but the client was emphatic about not wanting to do that - I don't know why, and I did not want to pry.

Thought you all might like to know the outcome anyway...

[Paul Komski]

Possibly the 95 diskette was not supporting long file names and thus not encountering any incompatible characters. Just a guess but possibly the case if you were deleting everything in 8dot3 format short names.

[mjc]

When using other methods, did you try the del *.* format?

But Paul's guess is probably correct...

[Mini-Me]

Yes, Paul, 8-dot-3 filenames, but with win98 boot disk, long-filenames show up on the right - this was not the case with the 95 boot disk...

MJC - Yep, tried del *.* using the 98 boot disk.

I know there are differences between the 95 and 98 command.com's, so...

It worked at any rate, so at least we have a satisfactory conclusion, and one to remember for future problems.

...although, this only works if the filesystem is FAT32, as it was in this case. If it was NTFS, I don't know that I would have been able to fix it...

[Paul Komski]

If it was NTFS, I don't know that I would have been able to fix it

The only way I know of to both create and also to get rid of an "undeletable" due to a reserved name (without wiping or deleting or formatting the whole partition) is to do it with a disk editor so that one modifies the sectors directly and thus not using a file system. With FAT it is relatively simple but more elaborate with NTFS.

See attached pic of such an undeletable, unrenamable, uncopiable, and unerasable (with Heidi eraser) file in an NTFS partition.

To get rid of it I used WinHex and found the file name in both its $Mft and $UpCase entries and changed them from, as it happens, con.e.txt to conf.txt and then rebooted to clear any $LogFile entries. The renamed file could then be dealt with quite normally.

WinHex is the only application that I have used that lets you manipulate the normally invisible and inaccessible metadata files (all prefixed with a $ symbol).

Bear in mind that simply deleting such a file in the above manner does not remove the underlying data until that $Mft entry and any associated extended attributes are all overwritten or zeroed. Hence the only way to properly sanitize such a drive is to wipe the whole thing. The file you managed to rename/delete is no different - the underlying data could be recovered without too much difficulty.

[Paul Komski]

Had an afterthought and found an even easier approach that worked immediately.

Knoppix deleted it without a qualm! Ran chkdsk on the volume afterwards just to be sure and it reported no problems.

[Mini-Me]

Had an afterthought and found an even easier approach that worked immediately.

Knoppix deleted it without a qualm! Ran chkdsk on the volume afterwards just to be sure and it reported no problems.

Well, that is intensely interesting, as I used a Knoppix CD to try to delete my problem files, and it would not delete them either.
:confused:

See my first post on this thread - Knoppix simply reported "Cannot delete file!" when I tried to delete single files, all files at once, or the folder containing the files.

Are you referring to Knoppix in the context of your con.e.txt file only, or other undeletable files too?

[Paul Komski]

I didn't have any undeletable files so I had to make one!

Knoppix and writing to NTFS volumes has a history so you may need a fairly recent distro; I was using 5.1.1. The other thing with writing to all partitions from the Live CD is that you may need to right click on its desktop icon and (as well as ensuring that the drive mounts when you open it) you may have to SPECIFY that you are allowing WRITE access.

PS

Another afterthought!! Create the files with Knoppix and see how Windows likes them. There are a number of reserved words as wel as CON. There are also PRN, AUX, CLOCK$, NUL, COM0, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, LPT0, LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, ...

So just to be doubly sure I created a text file called con.com1.paul.txt in Knoppix and, lo and behold, Windows will not rename or delete it: it doesn't exist!!
LOLOL :)

[Mini-Me]

Another afterthought!! Create the files with Knoppix and see how Windows likes them. There are a number of reserved words as wel as CON. There are also PRN, AUX, CLOCK$, NUL, COM0, COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, LPT0, LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, ...

So just to be doubly sure I created a text file called con.com1.paul.txt in Knoppix and, lo and behold, Windows will not rename or delete it: it doesn't exist!!
LOLOL :)

QUESTION: When there is such an obvious problem with Windoze and the naming of files like this, in that any file with a name like the ones you reference above becomes such a major pain in the posterior, why the hell was Windows source-code written to even allow this at all in the first place?

[Paul Komski]

It's not source code - to be pedantic - it's file names. And certain names and characters are forbidden. The above are reserved words even in most, if not all, versions of MSDOS. You wont normally be able to create such file names if using DOS or Windows normally - such file names that use them are thus "hacks".

Forbidden characters include the commonly used | / \ : * " ? < >

With code, so much always depends on syntax and every language has its own peculiarities. The must be ways of demarcating things like end of line and end of file and to this end the special nul character has very special uses in both MS and Linux encoding.

[Mini-Me]

It's not source code - to be pedantic - it's file names. And certain names and characters are forbidden. The above are reserved words even in most, if not all, versions of MSDOS. You wont normally be able to create such file names if using DOS or Windows normally - such file names that use them are thus "hacks".

Forbidden characters include the commonly used | / \ : * " ? < >

With code, so much always depends on syntax and every language has its own peculiarities. The must be ways of demarcating things like end of line and end of file and to this end the special nul character has very special uses in both MS and Linux encoding.

Okey dokey.
:)

Good point - my bad.
:D

How then do we EASILY defend against this kind of filename rape?

Is there any way other then the normal Windoze prompts we all get when we use illegal characters etc in a filename, to prevent this kind of thing happening again, or is it a virtual impossibility, just due to the fact that you CAN so easily rename files to an illegal name(mostly with a 3rd party app)?