Jump to content

Files keep showing up in Recuva


rjo98

Recommended Posts

Maybe i'm not understanding how it's supposed to work. I have Recuva set to securely delete the files, and dont have the option enabled to show securely deleted files.

So I run a Recuva scan, have it securely delete whatever it finds, then when i run recuva again, it finds the same files again and overwrites them again.

 

Shouldn't it have already overwritten the files from the first time I ran it, so they shouldn't show up as needing to be overwritten again?

Link to comment
Share on other sites

  • Moderators

Assuming you're running a normal (not deep) scan: Recuva extracts file names and the data address from the master file table. When Recuva securely deletes files it overwrites the file data. It does not overwrite the file names in the MFT. So if you selected all the files Recuva found, securely deleted (overwrote) them, and then ran Recuva again it would find exactly the same list of file names as before.

 

Recuva uses Windows commands to overwrite file data. There is not a command to overwrite the file names in the MFT, which is why they remain.

 

If you're asking why does Recuva show these overwritten files when you have don't show sec del files selected, I don't know. I don't know what criteria Recuva uses to identify a securely deleted file as there is nothing to specifically identify such a thing, it's just a file of zeroes.

Link to comment
Share on other sites

Ah ok, that makes sense. I just assumed that after Recuva overwrote the file data, it also overwrote the file name in the MFT somehow as well, so all traces of the file were gone.

 

So how does ccleaner do a "wipe mft free space" then, if there's no command to overwrite things in the MFT?

Link to comment
Share on other sites

  • Moderators

It allocates enough new files to fill all the unused records in the MFT and then deletes them. So the file names haven't actually gone, they've been replaced with nonsense names. So Windows, or more precisely the file system NTFS, does all the work.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.