Microsoft Inadvertently Ships Deleted Files

Disk image with evaluation software not properly wiped

By David Worthington

January 15, 2008 — (Page 1 of 2)
New technology may not always carry the seeds of destruction, but the possibility for a good pantsing is always there.

Microsoft’s use of virtual machines to distribute evaluation versions of software saves the end user much of the pain of having to configure test systems. However, it also introduces a new quality control issue by exposing the full dimension of data that was on the system when the virtual machine’s disk image was created, and last month, that issue caught Microsoft off guard.

The company began making disk images, or Virtual Hard Drives (VHDs), with evaluation versions available on a limited basis in 2005 and more generally accessible through Microsoft TechNet in November 2006, and had provided a way for partners to build their own prepackaged software stacks, using the Virtual PC technology it acquired from the now-defunct Connectix in 2003.

SD Times in December learned that at least one of the machine images available for download at TechNet did not have its free space wiped, and files thought deleted proved recoverable from an evaluation copy of the Internet Explorer Application Compatibility VPC Image.

Although there didn’t appear to be anything sketchy in that disk image, SD Times did observe what appeared to be a deleted third-party boot-time defragmenter program.

It also appeared that a Windows XP (with Service Pack 2) CD had been copied to the virtual PC’s hard drive and deleted. If the person that made the image deleted the XP files as the last thing she did, it might be possible to recover the entire CD. But in this case, other files were presumably added to the image after the deletion, thus overwriting many files.

A Microsoft spokesperson was unavailable when asked if it had a policy on how to prepare a VHD for distribution.

Voke analyst and founder Theresa Lanowitz remarked that it appears as if Microsoft lacked proper quality control. “It speaks to the process being not clearly defined. There are so many instances of things like that in the past,” she said.

Pages 1 2

Share this link: http://sdt.bz/31662