FILE-KO UTILITY PROGRAM

• Document Type: CREST
• Collection: General CIA Records
• Document Number (FOIA) /ESDN (CREST): CIA-RDP95-00972R000100210006-2
• Release Decision: RIPPUB
• Original Classification: K
• Document Page Count: 3
• Document Creation Date: December 27, 2016
• Document Release Date: February 2, 2012
• Sequence Number: 6
• Publication Date: May 11, 1987
• Content Type: MISC

STAT
STAT
STAT
-oved for Release 2012/02/02 : CIA-RDP95-00972R000100210006-2
kOUTIN~ TRANSMITTAL SUP
0 fNma oflk m 1, r oe, mnnba,
buI p, A ,oy0100)
Declassified in Part - Sanitized Copy Approved for Release 2012/02/02 : CIA-RDP95-00972R000100210006-2
 Declassified in Part - Sanitized Copy Approved for Release 2012/02/02 : CIA-RDP95-00972R000100210006-2
May 11,1987
FILE-KO Utility Program
The purpose of the FILE-KO Utility Program is to overwrite the file's
contents before deleting it.
The DOS Delete or Erase function only marks the file's directory entry
with one byte to indicate that the space occupied by that file can be
reused. Utilities designed to unerase or undelete a file can return the
file's data intact if the space has not been reused.
VERSION TESTED:
FILE-KO Version 3.2 dated 3/25/87
CRITICAL PROBLEMS:
The utility does not check the type of media in the disk drive. The
read/write heads of certain drives are only half the width of standard
drives. This can result in only a narrow portion of each track being
overwritten, leaving residual data in the remaining width of the track.
This data is potentially recoverable with special equipment. An example
would be deleting a file on a 320/360 Kbyte diskette, in a 1.2 Mbyte
drive, that was orginally written by a standard 320/360 Kbyte drive.
The utility only overwrites the portion of the file's allocated space that
is determined by the file's data size and adjusted to a sector (512 byte)
boundary. Files are allocated space based on clusters which can be a
multiple of sectors. This can result in residual data at the end of the
file's allocated space which can be recovered simply with the use of a
Norton utility. As an example, the 320/360 Kbyte standard allocation
format is 2 sectors per cluster. If the file to be deleted is 128 bytes
in length, only the first of 2 sectors of the file's allocated space would
be overwritten before deletion. The residual data in the last sector
could be data remaining from an editing session that reduced the file's
size.
The utility uses an ANSI.SYS command to clear the standard output device.
If the ANSI.SYS driver is not loaded, this results in garbage characters
being displayed on the screen. The use of this command assumes that the
standard output device is the video monitor but the DOS redirection
capability allows the standard output device to be changed which could
cause unpredictable results.
The utility uses the archaic architecture of File Control Blocks (FCB's)
which does not allow the use of path definitions. This results in action
being taken only on files that are in the current or logged on directory.
Files are overwritten once with an ASCII space character. This is not
consistent with the DISK-KO utility program which overwrites with
alternating writes of binary ones and zeros. After the file is deleted,
the directory entry FCB is left intact. This entry contains the file's
Declassified in Part - Sanitized Copy Approved for Release 2012/02/02 : CIA-RDP95-00972R000100210006-2
 I I l II
Declassified in Part - Sanitized Copy Approved for Release 2012/02/02: CIA-RDP95-00972R000100210006-2
May 11,1987
name, size, date and time last updated or created and the file's starting
sector on the disk. This data should be overwritten after the deletion
function.
Before any use or distribution of this program is considered, it should be
rewritten to be consistent with other security utility programs of this
type and to correctly perform its intended purpose.
STAT
Declassified in Part - Sanitized Copy Approved for Release 2012/02/02 : CIA-RDP95-00972R000100210006-2