Jump to content

Return to Piriform.com

Photo

Secure deletion of all deleted files- Recuva or Ccleaner?


  • Please log in to reply
5 replies to this topic

#1 OFFLINE junbug

junbug

    Member

  • Members
  • PipPip
  • 17 posts

Posted 31 August 2010 - 02:09 AM

Hi I have a question regarding both Recuva and Ccleaner. I am new to both this forum and Recuva, and I apologize if my frustration comes across as inappropriate regarding the nature of this Recuva forum.
I am confused over which program- Ccleaner or Recuva- has the ability to securely delete (overwrite) ALL of the already deleted files (leftovers) found on my computer (I believe that the sore reason of Deleting anything is to completely Delete).

It is my hope that a someone here with enough knowledge of both of the products could lend me a hand.
I would really appreciate your help.


My frustration is a result of conflicting (to my understanding) description given out by Piriform-

Piriform's description on Ccleaner's <Wipe Free Space> option:
"When you delete a file, Windows removes the reference to that file, but doesn't delete the actual data that made up the file on your hard drive. Over time, this data will be overwritten as Windows writes new files to that area of the drive. This means that, given the right software, someone could reconstruct all or parts of files that you've deleted. For privacy and security reasons, you can set CCleaner to wipe the free areas of your hard disk so that deleted files cannot be recovered."

Piriform's info on Ccleaner's <Secure file deletion> option:

"Note: CCleaner can only securely delete files which have not yet been deleted from the Recycle Bin. If you have already delete files insecurely (for example, using Windows Explorer), you can delete them securely using Recuva."


I apologize if I am misunderstanding anything, but these two descriptions seem to point at different ends. First description states that <Wipe Free Space> option on Ccleaner will remove the leftovers from deleted files so that it cannot be recovered. However the latter statement says that secure deletion of files, which prevents recovery of deleted files, does not apply to files that were deleted using Recyclebin, which means that insecurely deleted files are still recovarable after carrying out <Wipe Free Space> option.

Like stated earlier- my main focus is to securely delete(overwrite) all of the leftovers of already deleted files found on my PC (these files weren't deleted securely, and are recoverable for most part).

Does this mean that I need to use Recuva- and if so, is there an option in Recuva that would allow me to simply securely overwrite every recoverable deleted files found on my PC (as in one click instead of manually finding specific files)?

Or considering my case, is such total secure deletion of all already deleted files possible with the <Wipe Free Space> option on Ccleaner?
Thanks for reading and helping.


P.S
(Rookie Question): When I view scanned files on Tree View instead of list or thumbnail, it also shows some file paths or
files that I have not deleted. Is this normal? Couldn't I accidentally overwrite these as well?

#2 OFFLINE Augeas

Augeas

    Moderator

  • Moderators
  • 2,992 posts
  • Gender:Not Telling
  • Location:Where Stuff is made, UK

Posted 31 August 2010 - 03:19 AM

Ah, the ambiguities of the English language. I believe that what these two extracts are saying is:

1) Wipe Free Space is something you occasionally use to overwrite any and all files on your chosen disk that have already been deleted. WFS creates one or more large files that fill the entire disk, and then deletes them. Thus nothing that was in free space can be retrieved in its original form.

2) Secure deletion is a process you run against individual live (i.e. not yet deleted) files. CC does this by opening the file, overwriting the contents, closing it, renaming it, and deleting it. (I have simplified the process here!) So CC can only securely delete files that have not already been deleted by any method. Files in the Recycler are securely deleted by CC. If you have emptied the Recycler, or used shift/del to delete the files, you can't run CC Secure Deletion against them. You would have to run either WFS on the entire disk or use Recuva on selected files. You can run a scan in Recuva, select all the files found with the global tick box, and delete the lot if you wish.

The two options are independent, if you have deleted files from the Recycler then WFS will overwrite them. The second option discusses using Recuva to securely overwrite individual files that have already been deleted. which CC can't do.

Any more questions just ask.

#3 OFFLINE Nergal

Nergal

    Volunteer CCleaner Demon/Post Meddler

  • Moderators
  • 6,236 posts
  • Gender:Male
  • Location:Get off my Lawn, y'darn kids!
  • Interests:being grumpier
    Laughing
    Crying
    Sleep comes Later though.

Posted 31 August 2010 - 12:37 PM

Just to follow up on that which has been said. It is the thoughts of the majority of the community here, myself included, the Wipe Free Space in CCleaner only be run at the sale of a hard drive. For your purposes I would suggest the use of Recuva to completly delete files which have previously been deleted.
ADVICE FOR USING CCleaner'S REGISTRY INTEGRITY SECTION
DON'T JUST CLEAN EVERYTHING THAT'S CHECKED OFF.
Do your Registry Cleaning in small bits (at the very least Check-mark by Check-mark)
ALWAYS BACKUP THE ENTRY, YOU NEVER KNOW WHAT YOU'LL BREAK IF YOU DON'T.
CCLEANER, RECUVA, DEFRAGGLER AND SPECCY DOCUMENTATION CAN BE FOUND AT www.piriform.com/docs
Link to Winapp2.ini explanation

#4 OFFLINE junbug

junbug

    Member

  • Members
  • PipPip
  • 17 posts

Posted 31 August 2010 - 03:34 PM

I could not thank you enough for the replies. They helped me understand the procedures a lot better.
As a result, I have ran Wipe Free Space on Ccleaner (before I saw the second reply here) on both of the computers that I am working on, as my focus is to simply delete all, not save some and delete some. I do recall, (after reading the the second reply) reading a page in a forum that lists all Ccleaner features including one about using Wipe Free Space only when trying to sell the hard drive. I hope I have not caused a major problem to it.

Although it was my hope that cleaning and scanning overnight would do the job, the results of my work still left me with some questions that I cannot solve by myself. It is my sincere hope that you could find the answers to some of my frustrations regarding the results of my procedures.


Here are my Results:

1st Computer (XP): After Wipe Free Space with Ccleaner, ran another deep scan with Recuva. Result: Recuva lists thousands of files (in excellent condition) with names consisting of random capital Z's and periods (ex: ZZ.ZZZ...Z.ZZ) instead of the files it showed before Wipe Free Scan. These "Z" files have headers that contain repeated 0's instead of other numbers. I believe that these new files are the products of Wipe Free Space of Ccleaner. Wipe Free Space procedure on Ccleaner stated that it has deleted 7gb worth of files, but free memory size on my PC remains the same as before the Wipe.

Questions:
1) Should I use Recuva and securely overwrite these list of Z files found by Recuva to make sure, or are they securely deleted enough?
2) Why is my free space memory still the same (when Ccleaner process stated it was deleting around 7gb)?


2nd Computer (Vista): After Wipe Free Space, ran Recuva again. After deep scan, result: Unlike with the XP, Recuva lists most of the files that I have seen it scan before I ran Wipe Free Space. The conditions of these files have been altered somewhat, but some are still recoverable. In some cases, group of files even have previews regardless of its unrecoverable state (which is a big no-no concerning privacy). This led me to wonder if Wiping Free Space was effective at all?

Questions:
3) Why does all these files, with the original names, still appear on my Recuva list after Wipe Free Space was carried out?
4) Does this mean that I am left with the option of using the global checkbox on Recuva to overwrite every single file on the list? I have yet carried out such procedure due to my lack of knowledge concerning the safety of such procedure. Is this procedure recommended (safety-wise)?
5) Unlike in the XP's case, which Recuva states "(0 ignored)" after a thorough scan, the Recuva on my Vista states that around 200 were found while some 16000 files were ignored. What are these ignored files (deleted/non deleted)?


- Ultimately, like stated before, all that I am trying to do is simply get rid of any leftover of all previously deleted files. I do not need to recover much of anything. And this is coming across as being very long and rather confusing procedure for novices like me. I wonder what the substantial and crucial reasons were behind the system's design to leave a mess after its deleting procedures. Regardless, once again I thank with all my might for the time you spend reading and possibly helping me out. I appreciate it.

#5 OFFLINE Augeas

Augeas

    Moderator

  • Moderators
  • 2,992 posts
  • Gender:Not Telling
  • Location:Where Stuff is made, UK

Posted 31 August 2010 - 04:34 PM

Running WFS on occasion will not cause any harm. It is seen as causing some wear on your hard drive, but if you only run it now and again it shouldn't be a problem (I have never run WFS on a hd, only on a flash to see what it does).

1st computer: Files with ZZ names are usually produced by running secure delete, not WFS. Did you tick the Wipe MFT box? This option overwrites the file names held in the MFT: whether CC overwrites them with ZZ or some other name I don't know.

Recuva run in normal mode lists filenames from the MFT. WFS without the Wipe MFT option will not touch the MFT so Recuva will show the same result after running WFS as it did before.

The ZZ files have - or should have - been overwritten with zeroes. They do not need any other overwriting. These files can be recovered quite easily, but they will just be zeroes and of no interest to anyone.

WFS does not free any space at all. Secure - and insecure - deletion will. If CC says that it will delete x gb of space, and the filenames change to ZZ, then it looks as if you ran secure delete instead or as well as WFS.

2nd computer: Again, running WFS without Wipe MFT will leave the filenames in the MFT - these are what Recuva is showing. most of the filenames in the MFT will point to free space which WFS has overwritten. Some of the filenames will point to space that has subsequently been used by another file, which is still live, and this might be what you are seeing. Also small files (under 1k) can be held in the MFT entirely, and WFS will not overwrite them (nor will Recuva). Another possibility is that any locked files will not be overwritten by WFS.

One of Recuva's options is not to display zero length files. This will cause the 'x files ignored' message.

Describing CC and Recuva's little quirks lucidly and unambiguously is quite a task. I suggest you use both applications daily for eighteen months or so, you'll soon get the hang of it.

#6 OFFLINE junbug

junbug

    Member

  • Members
  • PipPip
  • 17 posts

Posted 31 August 2010 - 04:34 PM

hm.. I see.
It seems I do have the Free MFT box checked on my Ccleaner.
Considering that, I wonder why Recuva's on my XP and Vista show results differently.

So WFS and wiping MFT will result in the list of Z files instead of named files correct?
hypothetically- Is it safe to overwrite anything that Recuva shows in its scan result list
(without the show nondeleted files option checked)?


It also seems that already overwritten files cannot be overwritten again
by either Ccleaner or Recuva.