1. TechSpot is dedicated to computer enthusiasts and power users. Ask a question and give support. Join the community here.
    TechSpot is dedicated to computer enthusiasts and power users.
    Ask a question and give support.
    Join the community here, it only takes a minute.
    Dismiss Notice

USB Oblivion

By Jackkat
Apr 11, 2018
Post New Reply
  1. USB Oblivion deletes all references in the registry for previous used USB devices by deleting the keys. these deletions don't show up in the recycle bin where they could be erased with something like CyberScrub. So where are the deleted keys and could they easily be retrieved with some disc restoration software and consequently the usb device that's been used, can now be discovered.. It they were deleted and put into the recycle bin I could wipe then with Cyberscrub. Anyone have any thoughts. ?
     
  2. jobeard

    jobeard TS Ambassador Posts: 12,218   +1,363

    Those KEYS are just records in the registry and to remove a key, it just gets deleted, erased. There is no recycle bin for registry edits.

    Any System Restore Point has the 'current registry' instance. EVERY time you edit the Registry, you should create one to allow you to roll-back if necessary.
     
  3. Jackkat

    Jackkat TS Rookie Topic Starter

    Thanks for your answer but what I'm trying to find out could a software program recover those deleted keys since I have no way of wiping them with something like Cyberscrub unless I wipe the entire free space. Perhaps this type of data is not discoverable.
     
  4. jobeard

    jobeard TS Ambassador Posts: 12,218   +1,363

    Don't hold your breath - - it's in a System Restore Point or it's gone. Registry editing is not like deleting files which have an intermediate Recycle Bin.

    Registry keys are just records on HD within one of the Five registry files. When deleted, the pointers to them are deleted.
    When the Registry is compressed, those records become part of Free Space.

    When free space is defrag'd many are destroyed.

    When free space is compressed and overwritten, then and only then are they truly 'erased'

    Now working backwards, to 'discover deleted keys', one would need:
    • physical access to the machine
    • to boot from external media (aka not the users HD)
    • and a tool to scan for "specific kinds of data"
    btw; the registry structure is Key -> Data
    and the portion 'erased' per the above is pure data, no structure (just 4byte words or some string values) and no way to discern to what Key was it associated.
     

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...