Does Eraser's security message mean System Restore is disabled?

Q I have downloaded the free Eraser program to securely erase the unused space on my hard disk.

However, when attempting to run a task the following warning message was displayed: ‘This computer has had System Restore or Volume Shadow Copies enabled. This may allow copies of files stored on the disk to be recovered and pose a security concern.’

What does this mean? Have I disabled System Restore? What is the security concern?
John Howard

A With this message Eraser is simply stressing the fact that, with System Restore enabled, it may be possible for older, deleted files to be recovered.

The reason for this is that while Eraser is able to obliterate selected files or folders, or even overwrite all unused space on a disk with meaningless data, there is nothing it can do about recovery information stored in disk space occupied by System Restore files. (Shadow Copies, incidentally, is a Windows service that underlies System Restore, among other things.)

The point of this warning, then, is to highlight the potential for old or deleted information to remain in – and therefore accessible from – System Restore archives. If you or someone else uses a Restore Point to rewind the PC to a previous state, information you thought erased could resurface.

So, does this pose a security risk? The answer is yes, though the level depends on the version of Windows. In most versions of Windows XP, for example, System Restore doesn’t monitor, protect or store personal files and folders, such as Word documents and digital photos. Rather it logs changes to important system files, so that they can be undone at a later date.

If some unauthorised person used System Restore to return the PC to an earlier state then, by deduction, they may be able to work out what applications had been installed recently; or if particular user accounts had been added or had their names changed.

With Vista and Windows 7, though, the risk may be greater. This is because in these later versions of the operating system, System Restore’s remit was extended to monitor changes to personal files and folders – a feature called Previous Versions.

This is easily accessed in all versions of Windows 7 and Vista Business, Enterprise, and Ultimate editions: simply right-click a file and choose Restore previous versions.

This option isn’t present in Vista Home but the technology behind it (Shadow Copies) does operate in the background, so the risk remains – though it would require more effort for someone to resurrect the old information.

Finally, you asked whether you have disabled System Restore, and the answer is no – this message serves as nothing more than the explained warning. However, we feel we should point that there is a circumstance in which Eraser (or any other program for that matter) could lead to System Restore being disabled.

In order to function, System Restore needs a minimum of 200MB of free disk space. Executing the task in Eraser that wipes all unused space writes data to every last empty part of the hard disk – in effect filling it up. This is temporary, but as soon as the hard disk space drops below 200MB, System Restore will be disabled.

To turn it back on in Windows XP, click Start followed by All Programs then Accessories and System Tools and click System Restore. Now click the System Restore Settings link and, on the System Restore tab of the System Properties dialogue box, click to remove the tick from the ‘Turn off System Restore’ box.

In Vista or Windows 7, click Start followed by Control Panel, then System and Security followed by System and then click the System protection link on the left. Click to select an entry below Available Drives (usually C:) then click the Configure button and choose one of the top two radio buttons.