Jump to content

Augeas

Moderators
  • Posts

    4,542
  • Joined

Everything posted by Augeas

  1. Recuva only overwrites specific (deleted) files, not large areas of space. An SSD will not display the contents of deleted files, so secure erase or wipe free space is not required. The tenth refers to your username. I'm surprised you're not aware of Gustav M. Just a little joke on my part.
  2. It's all a matter of opinion really. I would ask why you would want to do that? I don't think I have ever wiped a flash drive or card. If there is a a file that you're worried about then use Recuva to overwrite it. Mass writes to flash are untimately destructive, especially if done on a regular basis. How are you getting on with the 10th? It's long overdue.
  3. That screenshot shows the settings in Custom Clean. If you are actually running Drive Wiper the settings shown above will not apply.
  4. I have never known overwritten files (that's what secure deletion and wipe free space does) to be recoverable - if the overwriting has actually taken place. If files are still being seen, and recovered, then they must be: 1) Small (under say 700 bytes) and held in the MFT and WFS hasn't wiped the MFT 2) Are actually live files which are now occupying the space the deleted files were 3) Were never actually overwritten in the first place I ran some tests a few years ago and found that WFS can miss some files. It appears that on a heavily fragmented disk, with many smallish unallocated spaces between files, the file allocation that WFS does is too large to catch these spaces (WFS allocates zero-byte files and then deletes them, thus overwriting free space). There may be other reasons that I can't think of. What does the Info pane of Recuva say about these deleted files? Just one or two would do. Can you overwrite these files in Recuva? Just one or two would do.
  5. Morning Janet, What error message are you getting when you attempt to recover those files? Your file system is probably NTFS.
  6. A bit late in the UK day to give a fuller comment, but hyphens and underscores are valid in file names in Windows. What is the file system?
  7. Deleted files in FAT32 should have the first byte of the file name altered, which is why you are seeing files with names like '_1046572.jpg'. Weirdly enough some deleted files have the full unaltered name, I don't know why. Files with '[000597].jpg names are found using a deep scan and have a chance of being recovered successfully. In FAT32 the root directory, and every other directory linked off it (where you and I and Recuva go to), have an entry for each file which holds the address of the first data cluster. The remaining clusters are chained together in the FAT. On file deletion the FAT chain is cleared so it can't be used for file recovery. Recuva follows the first cluster address in the directory and then reads forwards on the disk. This has problems as only the first extent of a file can be retrieved, thus a file with more than one extent may be unusable. This first extent only recovery is a specific problem with the FAT file system. File extents are chained in the FAT, and the FAT entries for deleted files are zeroed. The first extent only recovery also applies to files found with a deep scan, which looks directly at the disk clusters. Only the first extent can be found as there is no mechanism to link multiple extents. If you look at the Info pane in Recuva the allocated clusters is always (as far as I have seen) one count of clusters at a particular address. If this count (x cluster size) is less than the file size then you have missing extents. Unfortunately files with missing extents are unlikely to be viable, and missing extents are extremely difficult to find, certainly not with Recuva.
  8. That puts a different light upon it. It's probably some file system such as FAT or exFAT, or even something more exotic, so it's difficult to say what Recuva is extracting. if you run Recuva again and look at the file headers then if they contain zeroes or what looks like random data then you're probably not picking up valid file data, and recovery is more difficult.
  9. 'I ran the analyser, hit clean' makes me think that WFS from Options/Settings was used, as Drive Wiper has neither analyse nor clean functions. We need to know if WFS in Cleaner/Advanced was checked. We haven't asked whether the drive is an SSD. I can't remember (or never knew) if WFS from Options/Settings recognises an SSD and does a RETRIM instead of a zero-fill wipe. If so then asking NTFS to issue the RETRIM command may well only take a few seconds, and NTFS would do the RETRIM.
  10. I think it's a bit of flam. Recuva can't tell whether a file has been securely overwritten or not (not after the event anyway) as a secure overwrite is simply an edit. Recuva will list all deleted files from the MFT whether they have been 'securely overwritten' or not.
  11. Solved what problem? That WFS took only two seconds? I can't see the connection. If you are using WFS from Options/Settings then you must have Wipe Free Space checked in Cleaner/Advanced, otherwise nothing will happen.
  12. My Sys Vol Info folders are empty. The 24 files are, as the O/P listed, all system files required by NTFS to work. You can't avoid them. You can edit them, if you have a perverse nature (and a hex editor), but NTFS will change them back again a few seconds later. I know, I've tried it.
  13. If, in Recuva, you select Scan for Non-Deleted Files and run a standard quick scan then the 24 system files will magically appear. They will all begin with a $ sign, with the first being the $MFT.
  14. Yes, Drive Wiper in Tools is entirely independent of any other CC setting. It is confusing to have two ways of wiping free space within CC, but that's how it is. Anyway you seem to have found a solution.
  15. The 24 files ignored are most likely the system files that are reinstated after the device has been erased (by Drive Wiper) and then formatted as NTFS. They are ignored as Recuva ignores live files - unless you specifically ask otherwise. They will not contain any user data. There's quite a lot of confusion in this thread. I don't know if you were initially using Drive Wiper from Tools or Wipe Free Space from Options/Settings. Drive Wiper doen not, as far as I know, have an option to wipe the MFT, you get it whether you want it or not. Alternate data streams and cluster tips belong to Secure File Deletion, a separate process entirely that doesn't affect Wipe Free Space. Furthermore the WFS settings in Options/Settings are ignored by Drive Wiper. They are two different independent processes. Wipe Free Space in Options/Settings does not allow you to erase any live user data, and this is perhaps what you were using on the first run. Drive Wiper in Tools does allow a complete disk and data erase, which is what appears to have happened in the second run. The second run seems to have done the trick. Multiple passes should not be required and on NAND flash are positively horrendous.
  16. I sympathise with your problem, and can add little, a factory reset seems to be the way to go. In Win 10 system restore is disabled by default (except on updates, when it is temporarily enabled and then disabled again). So unless the user activates it, it will be disabled. But you should be able to enable it whenever you wish. I only use the registry cleaner to remove unknown file extensions and perhaps bad links to no longer there files, and that's only very rarely. I suspect that more complex systems - those with more applications installed - are at a higher risk from registry 'cleaners', especially if a Clean All approach is taken. But that, like the fact that both my chainsaws use low kickback chains, is of little use to you.
  17. Augeas

    Does Recuva work?

    Yes, it does work, with the proviso that no (Windows) file system was designed to assist recovery of deleted files, that's why there's a recycler. To avoid answering all your comments, does your 'freshly imaged computer' use an SSD for its system disk?
  18. Although Recuva doesn't find folders as such, it can search on folder name. However if the folder record in the MFT has been overwritten then it will find nothing, as I suspect has happened in this case. (It appears that there is a blank between windows. and old in your search criteria. Try again without it.) A deep scan will not find any folders, as no folder information is, or can be, acquired during a deep scan.
  19. The usual recommendation when Recuva is stuck on stage 2 (or 3) is to cancel the job. The list of files found is still displayed. I don't know what the cause is but Recuva is - I assume - trying to sort and analyse in memory the data found. Perhaps it is trying to extract further info from the disk. You have a specific file names in the path/filename box. It may be a better choice if you leave this box clear so that Recuva will return all files found, a sort of bigger net. You also say you are trying to recover a 24 gb file. On file deletion Windows' file system (NTFS) will delete cluster addresses on files larger than 4 gb, so the chances of recovering such a large file are somewhere between minimal and zero. Perhaps the lack of valid cluster addresses is causing Recuva to stall. Who knows?
  20. If your drive is an SSD, and if you are running Optimise and not a full defrag, then Defraggler will issue a RETRIM on the drive. This - either by requesting Windows to do it or by some other means - will issue a TRIM command to all unallocated pages on the SSD. It will not run a defrag, so the reported defragmentation percentage will remain unchanged, and presumably none of the pretty blocks will change colour. The file fragmentation percentage (and indeed the pretty blocks layout) is generated by looking at the files' Logical Block Addresses in the Master File Table. It has no bearing on where the files' data pages are allocated on the SSD, which nobody knows. It is, generally speaking, an irrelevance on an SSD. I would let Windows Storage Optimiser look after your SSD, and stop worrying. If you are running a full defrag or a zero-fill optimise on your SSD then please stop it.
  21. It's difficult to be definite, but yes is the overwhelming answer.
  22. For Windows and NTFS, for all practical purposes deleted files on an SSD cannot be recovered by any software. It's to do with the way the SSD controller manages file deletion.
  23. Contents being set to zero on deletion is typical of an SSD. Confirmation of whether the drive is an SSD or HDD would help.
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.