This is long but might be worth reading if you're concerned about security.
For the past week I've been trying to get rid of an OS 9 document that refused to budge because it was in the Twilight Zone. I don't know whether the same problem could occur in OS X, because I don't have the tools to find out, and discovering the Twilight Zone document was a fluke, anyway. But it wouldn't surprise me if the problem is cross-platform.
I was using my OS 9 Norton Utilites' Unerase application in "text search," looking for an unimportant file I really had no hope of finding. Text search offers the choice of looking for "erased files," "real files" or both. I had both checked.
A list of files appeared, and I was surprised because I regularly wipe the free space on all four partitions (two of which contain OS 9; I use one to maintain the other). Then I realized I had "real files" checked, which explained the list.
I couldn't find the long-gone file, but in examining what had turned up, I discovered that three or four in the list were copies of a legal document dating back a couple of years. It was in the OS 9 partition because I had used AppleWorks and QuarkXpress, and I don't have Quark for X.
The legal document existed only in the Norton Unerase disk scans of "real files" text searches. But I couldn't find it with any file search using 9 or X, including Spotlight, so I wiped that partition's free space again, using OS X's Disk Utility, as well as Norton's version of the same thing.
Another Unerase text scan — they take longer than geologic eons — revealed that the various iterations of that document were still there, and they existed as "real files" because they wouldn't show up when searching in the "erased files" mode, and wiping the free space wouldn't clear them, either.
The document — more than one version — was glued onto one or more legitimate files, but I had no way of finding out which, other than by tedious elimination of every file on the partition, then scanning the disk again after each change. I did this by trashing half the files (from the other OS 9 partition so I could use Norton), then scanning for the text, then trashing half the files that were left, then scanning for the text, until all that remained, of all things, was the system folder.
At that point the light finally dawned (but who'd a thunk?), and I ran the text scan again on the other 9 partition where I had stashed the clip board from the problem partition. The ghost document was back, but it was finally gone from the problem partition.
Way back when, I had copied the document's text from AppleWorks to QuarkXpress, but the clip board hung onto it as a real file. There was no way of knowing this, however, without the fluke discovery when I was looking for another document by typing in a name that had existed in both.
If you sell your computer, wipe everything, including the system, because if this happens in OS X, too, ghost files like that might reveal anything, including your financial data. That clip board could be a back door into your life.
I trashed the clip board and replaced it with the one from the other partition, then duplicated that one, too, and compressed it so I'd always have a clean version, then ran the text scans again on both partitions. There was no trace of the document, so I wiped the free space on both partitions once more, then decided it might be worth while to let you people know what happened, since I'm not the only one still running 9. And as I said, it may be happening with X, too.
I don't use virtual memory with OS 9, so the document hadn't been written to the disk that way. The clip board did that itself, so it doesn't always use RAM to keep everything in memory. How much junk does that clip board carry around with it, anyway? For all I know, there was a ton of it, but it would show up only with a specific text search.
No wonder stuff can be found on a disk years after it was supposedly erased. I guess it's true that the only way you can know for certain a disk is wiped is to tear it apart with a hacksaw then burn it with a blowtorch.
