Augeas
-
Posts
4,542 -
Joined
Posts posted by Augeas
-
-
Can you remember how much (in mb, gb) you are trying to clean? If you really want secure deletion then I should try 1 pass to see if that speeds things up, or if there are no secrets there then use normal deletion for fastest cleaning.
-
Morning Davey - going from the time of your post I think you are the opposite of SleepingTheNight.
<Some people are just stubborn,thick headed, and too self-opinionated to believe what is presented right before their eyes.>
I'm sure that doesn't apply to anyone in this forum! Rgds. (I have many lawns to cut on a beautiful summer morning.)
-
Augeas, you must understand that no secure file deletion method is foolproof. With the right amount of time, a data recovery expert, and the right softwware and hardware combination, any data can be recovered. The only way to permanently erase your data is to use very strong magnets and move them around on the disk. Then, melt the hard drive platters at a very high heat temperature, Then, smash the disk into little pieces, and throw it in the garbage.
Yes, yes, yes, but how many deleted files do you have?
To wander from the orginal question, I think it's safe to say that no overwritten data has ever been recovered, and none is likely to be in the future. Overwritten files (as opposed to data) are recovered from reconstructing data fragments from the many un-overwritten sectors that remain on the disk.
I use Gutmann's 35 pass file deletion method, it's incredibly secure, but sometimes the Windows file deletion skips certain other files if you use this method.Ah, Gutmann. How I wish he had kept his mouth closed, and how I wish Piriform had done a little research. It's a waste of time (34 wastes of time, actually), as Gutmann (to his credit) acknowledged when he stated in his original 1996 paper that you may as well overwrite the disk with one pass of random data.
I could bang on about this for hours. Rgds.
-
It's just the nature of Windows, or any file management process. If a file is deleted then the space it occupied can be used by part or all of any other live file. I have found from experience that even some old live files appear in the space that newer deleted files used to occupy, so Windows must be file shuffling to keep itself occupied.
When deleted files are displayed with Recuva or a similar program then you may well see some live files displayed. There is nothing that CC or Recuva can do to stop this. Whatever CC or Recuva uses to overwrite securely deleted files (and I use one overwrite which uses char zeroes) then it can be overwritten with live data within seconds.
Someone with more experience than me might suggest a workround involving partitions or separate drives which can overcome this.
-
Make sure that these files are being deleted by CC, and not by some other action such as your browser clearing its cache. CC will rename securely deleted files, so if you can still see the filename with Recuva then you aren't using CC for the deletion.
If you can 'see' the deleted files with Recuva, have a look at the info tab and make sure you are not actually seeing another file's contents that have overwritten your deleted file.
Some small deleted files may live in the MFT and cannot be overwritten by Recuva (but they can be deleted securely with CC).
If you use Recuva to securely delete overwritten files (see above) it will overwrite any residual sectors and mark the file as unrecoverable, but you will still be seeing the contents of the file that overwites it, and you will still be able to recover those contents.
Recuva's opinion on whether a file is recoverable is not always veracious, it's just a piece of software trying to make sense of the world. It will not stop an attempt at recovery.
I am not a fan of anything but a one-pass secure overwrite. Anything else is just a waste of effort. Rgds.
-
Actually re-reading your post and thread title, do you mean that you are deleting files using CC and then discovering them with Recuva?
CC with normal deletion will delete files just as if you had shift/del'd them yourself. They will be identifiable and recoverable with Recuva. Using CC with secure deletion (one pass please) will rename the files and overwrite them with binary zeroes, so you will not be able to identify them easily with Recuva, and not recover them at all.
-
My advice would be to edit your email address out of your posts. Recuva will not secure delete smaller files (1k or so) as they can be held in the MFT which is, as far as Recuva goes, inviolable. You will however get a message regarding this when you attempt the delete.
Recuva will not appear to delete files which have been overwritten by subsequent live files, as you will in effect be looking at the live file. It will overwrite the 'spare' parts of the old file though.
-
Perhaps the only response is that nobody here knows. We don't know what the other software is, and even if we did we could only make observations based on the behaviour of the software, just as we do with Recuva. We will always be observing from the outside.
I guess that your flash drive is FAT? How old is the other software? Were the files deleted months ago done on the same pc/op sys? I also guess that there's some glitch in the older software that's misinterpreting the size of the flash drive or the file organisation. Actually I haven't a clue.
Incidentally Keith the other difference between shift/del and the recycler is that files sent to the recycler and then deleted are renamed, and can caused confusion, but this doesn't seem to be relevant here.
-
Well, your suggestions are as good as mine. If I may say so CC is a software cleaner, not a HDD cleaner.
-
Maybe. Download Recuva and run a deep scan with the Scan for Non-Deleted Files option ticked.
-
Yes, and that's the one occasion when I used a disk wiper, when I passed on an older PC. I was a little tongue in cheek, wiping unused space is a waste of time. What needs wiping is used space. Anyway, I would prefer CC to be left alone and some other independent wiper to be used, on the rare occasion when it's needed.
-
There is a portable version of CC which can be installed on and run from a flash drive. CC runs on the system drive only (I don't know how it knows which is the system drive, I've rather boringly only had systems on the c drive). CC doesn't have a drive option as the default folders to be cleaned are installed on the system drive: it's not possible to differentiate between system folders which have been moved to a non-system drive and innocent user folders with the same name.
-
No, I don't want this, it's not what CC does. There are enough specialised disk wipers without adding code to a mercifully slim progam (but creeping up - software has human characteristics, starts off slender and desirable and then gradually goes fat and lazy).
Wiping unused space must be one of the world's most useless occupations. How often do people run these disk wipers? I've run one in about 15 years. As for removing deleted entries in the MFT, from what I know of the MFT, the way it allocates filenames, the MFT zone, it's mirror image, and Windows critical dependence on it, I wouldn't touch it with a barge pole. You only see deleted entries when you run something like Recuva, anyway.
-
I think that there is an option to run CC at boot up time: I don't know of a scheduler, but no doubt someone has a snazzy script somewhere. As for when to run, different users will have different needs and habits. I don't do a great deal of downloading so I run CC manually now and again, say once or twice a week. I only have about 20 mb a time to delete. It's up to you really, CC is just an easy way to clear out all the tat that accumulates.
I don't usually switch on secure deletion, only when I have some particular and sensitive files to get rid of. Then I run CC in ordinary mode, dump the sensitive files into a folder which is in CC's include list, and run CC in secure delete mode. Others will have their own idiosyncrasies.
-
Yes, I would install Recuva. It's perfectly harmless and shows deleted files on your disk. As deleted files are overwritten when new files are created not all deleted files going back to year dot will be shown. If you run a deep scan Recuva will find many more deleted files, but will take hours to run. You can recover whatever files you chose so malware - unless it is hidden in a valid file you chose to recover - will not be recovered. Not all files you recover will be valid, as they may have been partly or wholly overwrtiien.
I should download it and try it out.
-
I agree, it sounds contradictory, I assume it means (as I interpret the OP's case) that live files on a disk that is not accessible (i.e won't boot up, can't be read normally) will be able to be recovered with Recuva. Sounds complicated to me. Perhaps Ron can elucidate.
-
I have used PhotoRec ( http://www.cgsecurity.org/wiki/PhotoRec ) to recover most of the data I need now. I thought Recuva could do the same easily.
As far as I can tell Recuva, in normal scan mode, reads the disk's MFT and reports on those entries marked as deleted. In deep scan mode it scans every used sector(?) on the disk and reports on these. I don't know whether deep scan also reads the MFT, I've never really thought about it. In neither mode does Recuva appear to scan live files (how, in deep scan, it knows what sector is live and what isn't I haven't though about either). Anyway, your pics are recovered so problem solved.
-
With CCleaner, no. You can search for deleted files and recover them with Recuva. This will only look for files, and some may already be overwritten: however the expression 'club penguin information', whatever that is, doesn't sound like files are missing. What is this info?
-
I should tick the files to be deleted at the moment, and them select Secure Delete Checked. (If you highlight files and then aren't positioned over the files when you select Secure Delete Highlighted the files will not be deleted.)
Do you get the Operation Complete box? If so, what does it say after the filename?
How large are the files to be deleted?
-
Does the box saying Operation Complete display 'Not Deleted - File is Resident in the MFT' next to the file name? If so then you are trying to delete a small file that fits entirely in the MFT. You will not be able to overwrite these files in the MFT.
If it doesn't, what does it say?
-
Hmmm, ebay, member no longer active... could just be a 1 gb drive dressed as 16.
-
Ummm, I've just eaten, and that reminds me to compliment our Louisiana friends for Tabasco sauce. Works wonders on anything (except rhubarb and custard), would even bring a slice of bread to life. Just splash it on! Turns any dross to gold. Yummmmmm.
-
You could try running a deep scan in Recuva (in the Options). This will take some time, depending on the size of your disk and the speed of your machine. Then filter the zillions of files for .doc extension and recover those to a flash drive. You may be in luck.
Remember that every action you take with your disk, booting up, any activity, etc will run the risk of overwriting a deleted file making it impossible to recover, so use your pc very sparingly. Always trecover to a different medium, a flash drive is fine.
-
How many deleted files do you have?
in Recuva
Posted
Hello Flower (are there 21 other flowers too?). Check in the Options/Advanced that you haven't ticked Deep Scan (should be unticked by default). I only have Show Files in Hidden Directories ticked. The scan also tells you what percentage you have reached. You can cancel Stage 2 (if it ever gets there) with no ill effect at all.
Recuva in normal scan mode only reads the MFT so it should be very quick, seconds really.