16 replies to this topic

[vincentauto]

12-24-08...

I Haven't Been Here Some Time...Updated 3 New Versions, Latest:1.21.373...Find Same Problems Recuva Recovers Everything...Will Not Secure Delete Anything!?

3 Versions Back I Could Secure Delete 300 Photos --Still To Date It Reads:

0 Files Deleted In 3 -10 Seconds?! Frustration... Search Other Software:

Found: No File Recovery... Found: Revo Uninstaller Has Own (Tools) Evidence Remover It Works, But Takes 1 to 1/2 Hours To Run...

You Guys Got Recuva To Recover Photos So Well It Will Now Not Delete Anything!?

Recuva Does Weird Stuff--I Spend Close 12 Hours Internet...Off Internet: Then I Run Recuva Deep Scan--Recuva Pulls Up All Any Photos Of All Web Sites I Visited:

In Particular: News Photos On Aol.Com...Photos On My Space.Com... That I Didn't Even Click On!?
Hope You Gain Some Insight From This...

Vincent Auto

[davey]

vincentauto, on Dec 25 2008, 01:37 AM, said:

Hello again Vincent,
Just as before I don't know why you are the only user that I know that can't get Recuva to "secure delete" any items.I can only recommend that you follow the instructions in our previous posts.

In regards to all those pictures that Recuva finds, every time you visit any website the website may download pictures and icons etc.. Even if you do not scroll down the page to see those pictures they have been downloaded into your Temporary Internet Files. When your Temporary Internet Files are deleted the pointers to those pictures are removed but the magnetic data stays on your Hard Drive. If you use CCleaner with "secure delete" this magnetic data will be overwritten with magnetic "zeros". Then Recuva will not be able to "Recuva" the data. Normal deletion is much faster but does not overwrite any data. Overwriting data is a waste of time for most users.

Believe me Recuva will "secure delete" files if you tell it to do so but you must follow the steps as I explained to you in previous posts.
Best wishes, davey

[Augeas]

Hi Vince,

Right. Do a scan with Recuva. Pick a harmless file, right click on it and select Secure delete Highlighted. There will be a Do You Really Want to do This box, select yes, and there will (should) be a Deleted 1 Files in 0.0x sec message.

If you don't get this message then either you have highlighted one file with left click, or several with left click/shift, and then right clicked when the mouse is not over the highlighted area. The box will say Do You Really Want to Delete 0 Files, and indeed will not delete anything. Using the tick boxes instead of highlighting will solve this.

If the files are small (1k) they may be resident in the MFT, in which case you can go through the motions but the final message will include Not deleted - File is resident in the MFT.

You can not of course securely delete an undeleted file, if you have chosen to show these in your scan.

Other mysteries are when the deleted file has already been overwritten, sometimes with a pic, so that it shows the pic that's overwriting it. You can secure delete the file, but it will still show the overwriting pic, as that is a live pic and won't be touched. However this won't be the cause of your 0 Files deleted message.

That's about all I can think of at the moment. Champagne and orange juice awaits me (OK, Cava and oj, we're not that rich), so I'm off to indulge. Happy Christmas everyone, especially you insomniac Americans.

[cwalt]

Augeas, on Dec 25 2008, 04:53 AM, said:

Hi Vince,

Right. Do a scan with Recuva. Pick a harmless file, right click on it and select Secure delete Highlighted. There will be a Do You Really Want to do This box, select yes, and there will (should) be a Deleted 1 Files in 0.0x sec message.

If you don't get this message then either you have highlighted one file with left click, or several with left click/shift, and then right clicked when the mouse is not over the highlighted area. The box will say Do You Really Want to Delete 0 Files, and indeed will not delete anything. Using the tick boxes instead of highlighting will solve this.

If the files are small (1k) they may be resident in the MFT, in which case you can go through the motions but the final message will include Not deleted - File is resident in the MFT.

You can not of course securely delete an undeleted file, if you have chosen to show these in your scan.

Other mysteries are when the deleted file has already been overwritten, sometimes with a pic, so that it shows the pic that's overwriting it. You can secure delete the file, but it will still show the overwriting pic, as that is a live pic and won't be touched. However this won't be the cause of your 0 Files deleted message.

That's about all I can think of at the moment. Champagne and orange juice awaits me (OK, Cava and oj, we're not that rich), so I'm off to indulge. Happy Christmas everyone, especially you insomniac Americans.

I need further guidence on your statement, 'You can not of course securely delete an undeleted file, if you have chosen to show these in your scan".
Can you only securely delete a file that has already been deleted by other means? If so, what other means?
You can tell, I am really in waaayyyy over my head. Please help

[Augeas]

Yes, a little confusing even to me. I mean that you can chose, by selecting the relevant option, to show undeleted files in a Recuva scan. However these files cannot be securely deleted by Recuva, which is quite sensible. Recuva will only securely delete already deleted files. That is files previously deleted by any means which it finds in its scan.

I think that the Recuva secure delete option should be named 'Securely overwrite' files, as deleting deleted files is silly, really.

If you want to delete a live file then use CCleaner. You can securely delete live files with CC, which is a more correct usage of the term. Or if you're not bothered about secure deletion just delete them to the recycler, or using shift/del, or using your browser clear files option, etc.

[jayr]

Hi, I have to chime in on this business about Recuva being unable to overwrite deleted files due to 'file is resident in the MFT'. I did a deep scan, found 2393 deleted files, and Recuva can't overwrite most of them because of this.

I'm somewhat baffled that there are thousands of deleted files that have been 'gone' for years, but somehow they are 'resident' and can't be wiped. How can I do this with Recuva? If I can't do it with Recuva, what CAN I use to do a wipe? I'm using version 1.26.416 of Recuva.

TIA.

(FYI: I discovered Recuva by reading a Lifehacker article, which I found using Digg. Maybe the tool has newfound popularity, so I'm sure that eventually others will also encounter this roadblock. For that reason it would be good to learn of a solution that can be found using Google. Thanks.)

[Augeas]

It's true that Recuva doesn't have the ability to delete files held in their entirety in the MFT. I understand that some disk washeres, such as Eraser, can overwrite these MFT entries. They do this by first filling the entire disk with large temp files, then allocating small temp files until the MFT is full, then deleting all they have created. They have to do this as the MFT never releases its used slots and never shrinks in size (in XP, not too sure about Vista).

You can do this yourself by creating enough temp files of more than 1k in a series of temp folders so that eventually all the entries in the MFT will be allocated a dummy file name and the contents overwritten. (Keep checking with Recuva.) Then delete the lot. This is mimicking the disk washer techniques, but without doing the whiole disk. Of course you'll have to keep doing this as new files resident in the MFT are created.

Or do what I do, ignore them.

[cwalt]

Augeas, on May 6 2009, 09:22 AM, said:

It's true that Recuva doesn't have the ability to delete files held in their entirety in the MFT. I understand that some disk washeres, such as Eraser, can overwrite these MFT entries. They do this by first filling the entire disk with large temp files, then allocating small temp files until the MFT is full, then deleting all they have created. They have to do this as the MFT never releases its used slots and never shrinks in size (in XP, not too sure about Vista).

You can do this yourself by creating enough temp files of more than 1k in a series of temp folders so that eventually all the entries in the MFT will be allocated a dummy file name and the contents overwritten. (Keep checking with Recuva.) Then delete the lot. This is mimicking the disk washer techniques, but without doing the whiole disk. Of course you'll have to keep doing this as new files resident in the MFT are created.

Or do what I do, ignore them.

[cwalt]

Sorry about the previous msg. Don't know how that happened. What I was trying to say was:
How do you create enough temp files 1k or larger to completely fill the MFT?

[Augeas]

Hard work. Just create a text file with zeroes in or something similar, copy and rename it ad nauseum. If you really want to do this then I would create a folder with say 100 files, then copy the folder umpteen times. Keep scanning with Recuva with the results sorted by size. Eventually (in theory, I've never done this) all these small entries will be overwritten. Once there are no files found by Recuva under 1k stop creating folders. Then delete all your folders (except one, to keep for next time). Personally I don't think it's worth the bother. As soon as you've finished another one will pop up. A free disk washer should do the same thing, but I don't use those either.

[jayr]

I didn't think I needed to go into everything I did before this point, but here's a summary: I zipped a 4.2 GB ISO file using 256 bit AES encryption, and copied it over and over until I had less than 4.2 GB open space on disk. Then I copied successively smaller and smaller Windows .exe & .dll files, over and over, until there was 0 bytes open space remaining. Then I ran Eraser to remove cluster tips. Then I deleted all the filler files I had created.

Guess what? Thousands of old deleted files still remained, I could undelete them and also see the data portion with Recuva's eyecatcher and could also see/recover them using Testdisk under the Parted Magic Live CD.

Of course, this nonsense of repeatedly writing dummy files should be unnecessary if the overwrite function worked, right? Plus, what are we going to do when we have a 300+ GB drive and are only using 20-30 GB of it for permanent files?

I hope Recuva's authors understand that these workarounds emphasize Recuva's inability to overwrite deleted data. Hopefully, they will either solve this, or explain why it can't be done. If we don't hear anything from them at all, I would assume that Recuva can't be used to overwrite deleted data (most of the time).

Thanks anyways.

[Augeas]

Jay, you originally asked about removing files resident in the MFT, and were pointed to Eraser as one option to do this. I can't understand why you went to all this trouble when you have Eraser installed and even ran it at one point.

We know Recuva won't overwrite files resident in the MFT. I don't know why, but I believe it's to do with some restriction in the Windows APIs that Recuva uses, and for integrity. Eraser gets over this by filling the disk with dummy files then deleting them. Recuva doesn't do this.

The nonsense about creating dummy files (and it is nonsense) is a modest attempt to clear out the files resident in the MFT without filling the disk. You seem to have tried to copy Eraser's function and fill the entire disk, a thankless task.

To be honest I can't tell what's on your disk. If you really want to wipe up the dross why not just run Eraser? Recuva has a certain set of functions, Eraser has another: just use whichever suits your needs.

[jayr]

I used Eraser to handle the cluster tips, I thought I had everything else covered by filling free space, I thought that would overwrite the deleted files. If Eraser has an option that massages the MFT until it no longer exhibits this issue, I don't know what that is (I didn't know about the MFT problem at the time). I'll have to look at it closely next time I run into this.

I couldn't wait so I used Terabyte's Copy/Wipe and have hopefully scrubbed the entire drive. I'm running Test Disk under the Parted Magic Live CD right now to see if anything is viewable, and will then restore from backup, using Terabyte's Image for Windows.

I sure hope it didn't backup the deleted files...

Thanks again.

[jayr]

Update: The restore completed, all the undeleted files are back, they are apparently backed up as well. I booted into Windows, installed a new utility called 'Undelete Plus', GUI looked promising but upon commencement, it is stuck in a 'start sector invalid / end sector invalid' loop and is not moving. There is no means of user support at their website. Looks like these tools are mostly window dressing.

If this were my drive I would have already applied my preferred fix: A sledgehammer and an anvil. Ufortunately, I have to restore that backup somewhere, sometime.

[jayr]

Update: I went back to look at Eraser, I was already using the latest 5.3 and I had ALL options checked, not just cluster tips but also "Free Disk Space (and Master File Table Records)". So, without knowing it, I had already covered whatever Eraser was going to do in this regard. Now what?

BTW, I found the following thread, old but very much a current topic. Unfortunately, no solution came from it:

http://www.wilderssecurity.com/archive/ind...hp/t-58283.html

I read the arstechnica link at the end, detailed discussion on MFT but nothing that addresses the security aspects of wiping files.

[jayr]

Update (Last): I decided to give Eraser one more try, I took the newly restored XP partition and reduced its size so that there was only 400MB of free space (used BootItNG for the resize). Ran Eraser with all options checked, then loaded TestDisk using the Parted Magic Live CD.

Guess what? Tons of deleted files were still there. I give up.

[Augeas]

Eraser does have a good reputation so I'm inclinded to think that there's something peculiar with your setup. Maybe an Eraser user (I'm not one) could go through this step by step with you.