System Cleaner

BleachBit is an open-source system cleaner and privacy tool for Windows and Linux that permanently deletes files, clears browser cache and history, removes application data, and securely wipes free disk space to prevent forensic recovery of deleted files. It provides comprehensive digital housekeeping for privacy-focused users.

For OSINT investigators, BleachBit is relevant in two contexts. First, for investigation environment maintenance — after investigation sessions, BleachBit can be used to clean investigation device browsers, application caches, and temporary files that accumulate during research, preventing residual investigation data from persisting on devices unnecessarily.

Second, for understanding what a subject may have done to cover their digital tracks on a seized or examined device. When digital forensic examination reveals BleachBit has been run — which Windows event logs, prefetch files, or uninstalled application records may indicate — it suggests deliberate evidence destruction. The timing of BleachBit runs relative to known events can be forensically significant.

BleachBit's secure deletion capability uses DOD 5220.22-M, Gutmann, or simple overwrite patterns to make deleted files unrecoverable. This is relevant both for investigators maintaining secure research environments and for forensic analysts assessing whether a subject attempted to conceal evidence.

For Windows environments, BleachBit can clean browser artifacts from Chrome, Firefox, Internet Explorer, and other browsers — the same artifacts that browser forensics tools attempt to recover. Understanding what BleachBit removes helps forensic investigators assess what evidence may have been destroyed.

BleachBit has open-source code that can be inspected, making it trustworthy for investigators who need to verify exactly what it does and does not delete.

In investigation environment management, run BleachBit after completing investigation sessions where sensitive browsing history has accumulated. Document the cleaning actions performed and timestamp for operational security records.