This paper reviews and tests Zilla Data Nuker 2.0, a free file-shredding utility developed by Zillasoft, LLC. Using a methodology adapted from the National Institute of Standards and Technology (NIST) Computer Forensics Tool Testing project, the author evaluates whether Zilla Data Nuker's shredding algorithms can render deleted files unrecoverable. The test involves creating and deleting an MP3 file, first through the standard Windows Recycle Bin process and then via Zilla Data Nuker, with recovery attempts made using eData Unerase Personal 3.0. Results indicate that files deleted with Zilla Data Nuker could not be recovered by the third-party tool, while files deleted through Windows alone were easily restored. The paper concludes with a discussion of the software's privacy implications and its limitations relative to professional forensic tools.
Files created or downloaded leave a trace even when deleted. These traces allow skilled computer forensic professionals to retrieve the data. Zillasoft, LLC, a New England-based software development company, provides Zilla Data Nuker, which "shreds sensitive files so they cannot be recovered or undeleted," according to the promotional material for the software (Zilla Data Nuker 2.0, n.d.). Zilla Data Nuker is freely downloadable from the ZDNet website or can be obtained directly from the Zillasoft website.
Zilla Data Nuker uses what the company terms "shredding algorithms" to obliterate data. The software is designed to improve the functionality of a home or office computer by deleting unnecessary files from the hard drive. Zillasoft also claims that the software can help protect the user's privacy by completely destroying information targeted by Zilla Data Nuker.
This tool might be used by someone who wants to delete personal files containing sensitive information, or by someone working for a company attempting to "prevent employees from wasting company time on things such as pornography and music downloading" (Rothke, 2004). Many companies are beginning to more closely examine the files on employee computers to ensure that misuse is not taking place. Zilla Data Nuker claims it can remove such files not just from visibility, but from existence on the hard drive. Since the Enron case, in which data was destroyed by the terabyte, "recovery and analysis of data has come to form a central part of internal investigations" (Marlin, 2004). Yet with every advance in detection software comes a corresponding advance in obfuscation software.
Using a tool that operates with a graphical user interface (GUI) within the Windows environment, such as Zilla Data Nuker, has some inherent drawbacks. Some proponents of command-line forensic tools "argue that most users really do not know what is going on when they 'point and click' their way around a computer forensic examination" (Kuchta, 2001). This may be a valid point, though it is somewhat beyond the scope of this review, since the testing information is not being submitted in a legal proceeding. In contexts where the specifics of a program's processes are at issue, software experts from the developing company are often required to help establish the reliability of the program.
"The Computer Forensics Tool Testing project at the National Institute of Standards and Technology (NIST), an agency of the United States Department of Commerce, was designed to provide a measure of assurance for the software tools used by law enforcement in computer forensics investigations" (General Test Methodology, 2001). The test method is a combination of the software used for testing and the procedures for completing the testing (General Test Methodology, 2001). Each of the applicable procedures mentioned in the U.S. Commerce Department prescribed methodology has been included below.
Title stating what product was tested: Zilla Data Nuker
Identification of the testing environment: Local corporate office.
The name and address of the vendor: Zillasoft, LLC. The address was unlisted on the website. After conducting a WHOIS search for the Zillasoft domain, it was found that the company has a private registration. The address for the hosting company is: H4Host.com, Lubbock, Texas 79408, United States.
Unambiguous identification of the product tested including version, patches, etc.: Version 2.0.
The test with the criteria for measurement: An audio file called 1.mp3 was created and then deleted and emptied from the Windows Recycle Bin. Once deleted, third-party undelete software (eData Unerase Personal 3.0) was used to attempt to retrieve the file. This procedure was then repeated with Zilla Data Nuker used to delete the file, and the same third-party undelete software used to attempt recovery.
"Recovery outcomes with and without the tool"
"Privacy implications and tool limitations discussed"
Always verify citation format against your institution’s current style guide requirements.