USB Oblivion

[Jackkat]

USB Oblivion deletes all references in the registry for previous used USB devices by deleting the keys. these deletions don't show up in the recycle bin where they could be erased with something like CyberScrub. So where are the deleted keys and could they easily be retrieved with some disc restoration software and consequently the usb device that's been used, can now be discovered.. It they were deleted and put into the recycle bin I could wipe then with Cyberscrub. Anyone have any thoughts. ?

 

[DelJo63]

Those KEYS are just records in the registry and to remove a key, it just gets deleted, erased. There is no recycle bin for registry edits.

Any System Restore Point has the 'current registry' instance. EVERY time you edit the Registry, you should create one to allow you to roll-back if necessary.

 

[Jackkat]

Thanks for your answer but what I'm trying to find out could a software program recover those deleted keys since I have no way of wiping them with something like Cyberscrub unless I wipe the entire free space. Perhaps this type of data is not discoverable.

 

[DelJo63]

Don't hold your breath - - it's in a System Restore Point or it's gone. Registry editing is not like deleting files which have an intermediate Recycle Bin.

Registry keys are just records on HD within one of the Five registry files. When deleted, the pointers to them are deleted.
When the Registry is compressed, those records become part of Free Space.

When free space is defrag'd many are destroyed.

When free space is compressed and overwritten, then and only then are they truly 'erased'

Now working backwards, to 'discover deleted keys', one would need:

• physical access to the machine
• to boot from external media (aka not the users HD)
• and a tool to scan for "specific kinds of data"

btw; the registry structure is Key -> Data
and the portion 'erased' per the above is pure data, no structure (just 4byte words or some string values) and no way to discern to what Key was it associated.