rjo98 Posted September 15, 2012 Share Posted September 15, 2012 Maybe i'm not understanding how it's supposed to work. I have Recuva set to securely delete the files, and dont have the option enabled to show securely deleted files. So I run a Recuva scan, have it securely delete whatever it finds, then when i run recuva again, it finds the same files again and overwrites them again. Shouldn't it have already overwritten the files from the first time I ran it, so they shouldn't show up as needing to be overwritten again? Link to comment Share on other sites More sharing options...
Moderators Augeas Posted September 15, 2012 Moderators Share Posted September 15, 2012 Assuming you're running a normal (not deep) scan: Recuva extracts file names and the data address from the master file table. When Recuva securely deletes files it overwrites the file data. It does not overwrite the file names in the MFT. So if you selected all the files Recuva found, securely deleted (overwrote) them, and then ran Recuva again it would find exactly the same list of file names as before. Recuva uses Windows commands to overwrite file data. There is not a command to overwrite the file names in the MFT, which is why they remain. If you're asking why does Recuva show these overwritten files when you have don't show sec del files selected, I don't know. I don't know what criteria Recuva uses to identify a securely deleted file as there is nothing to specifically identify such a thing, it's just a file of zeroes. Link to comment Share on other sites More sharing options...
rjo98 Posted September 20, 2012 Author Share Posted September 20, 2012 Ah ok, that makes sense. I just assumed that after Recuva overwrote the file data, it also overwrote the file name in the MFT somehow as well, so all traces of the file were gone. So how does ccleaner do a "wipe mft free space" then, if there's no command to overwrite things in the MFT? Link to comment Share on other sites More sharing options...
Moderators Augeas Posted September 20, 2012 Moderators Share Posted September 20, 2012 It allocates enough new files to fill all the unused records in the MFT and then deletes them. So the file names haven't actually gone, they've been replaced with nonsense names. So Windows, or more precisely the file system NTFS, does all the work. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now