

There are several processes running on your computer that may be saving copies of data in various places on your machine. They are not easy to recover!

I opened a new worksheet in Excel; enter and analyze some confidential information and then close but don't save the worksheet. My question: Is that worksheet and it's data still retrievable in any way, shape or form?

In this excerpt from Answercast #41, I look at ways that unsaved data may be saved to your computer and how to protect yourself.

Recovering unsaved data

The short answer is probably. The longer answer is, "We're not really sure how."

There are a couple of different things that can go on.

  • Microsoft Office applications in general save temporary recovery files.

So, for example, you've probably seen features like Auto Save. If you've ever had Word or Excel crash on you, very often they will be able to return you to a recovered (or what they'll call a "recovered") copy of the document that you were working on.

  • What that is, is the program simply recognizing that there is still a temporary file around that had some version of your work in process.

Temporary files

My assumption is: even if you've not saved the file even once, as it appears to be your case, Microsoft Excel is still saving a temporary file of some sort. If not for auto-recover then for its own data management purposes.

  • So, ultimately, yea, that file could probably be undeleted.

I'm sure that Microsoft Excel deletes the file when it's done. But, as we know, when you delete a file in Windows, all that really does is mark the file or mark the space that the file used to take up as being available.

It's not actually overwritten until some other file comes along and happens to write on top of the same space.

Wipe the free space

So, one approach of course, would be to then:

  • Make sure that you run a secure delete (or a free space wiping program) after a situation like this that you care about.

Paging file

Another problem (and this one is actually a more obscure one that I'm much less concerned about, but it needs to be included for completeness)...

If your machine is tight on memory and Excel happens to be swapping to your paging file:

  • We actually don't know what's being written to the paging file;

  • It is a memory image of what's going on in your document; what that looks like I don't know.

Is it possible that something could be recovered from that? Maybe. If someone were really intent on understanding the internals of Excel and rummaging through god-only-knows-what the paging file would contain.

So, theoretically there's a possibility that's still there too.

Use encryption

The final option, that somebody has pointed out as being one way to deal with that, is to use an encrypted folder as the place to keep the file; and possibly your temporary files.

Now, like I said, because you're not actually saving the file:

  • It's not clear exactly where the data is actually being placed.

  • It is likely to be in the system temporary folder – not quite sure.

Again, don't hold me to that. When you have a file that you're saving, that file and its temporary file are usually located in the same folder.

Whole disk encryption

The only solution I have that really helps in a situation like this (to prevent access after the fact) would be to use something like whole disk encryption – which seems like overkill for this scenario that you're looking at.

What that means is that:

  • As long as the drive hasn't been mounted (in other words, the password has not been provided to actually mount this disk that has been whole drive encrypted);

  • Then the data is not accessible.

  • None of the data is accessible whether it's deleted files or not.

Of course, as long as it is mounted, as long as the machine is operating, then all of the previous scenarios that I've outlined about files being undeleted still apply.

So that also seems like overkill for this.

Sensitive data

Ultimately, it really depends on just how sensitive this data is.

In your shoes, for something that I felt that was very sensitive, I would probably feel safe enough by using a secure free space wiping program to clear up the area of the disks that used to contain the temporary file that was just deleted when you finished your Excel session.

  • But it's an interesting problem.

  • There are all sorts of little nooks and crannies where data can get stored.

Depending on just how sensitive the data that you're talking about is, and just how dedicated someone might be to retrieving that data, the possibilities get kind of complex pretty quick.

Article C5664 - August 6, 2012 « »

Share this article with your friends:


Not what you needed?

1 Comment
August 13, 2012 9:42 AM

Yes, it saves the data by default

Comments on this entry are closed.

