How to Delete Using Recuva

[Aeneas]

So, I have opened Recuva, scanned my drive, obtained a list of files on the drive (including those deleted by CCleaner). Now, what steps should I take to delete these files using Recuva?

[Whiteshark]

First select in Options > General which kind of deletion you want to perfom (1, 3, 7 or 35 passes).

Then, after the scan, highlight or select the files, right click the log and select 'Secure Delete Highlighted' or 'Secure Delete Checked'

 

[Aeneas]

First select in Options > General which kind of deletion you want to perfom (1, 3, 7 or 35 passes).

Then, after the scan, highlight or select the files, right click the log and select 'Secure Delete Highlighted' or 'Secure Delete Checked'

 

 

 

Thanks. I did as you suggested (using the 3 passes deletion mode) and Recuva deleted a number of files, but hundreds remain with the message "Not deleted. File resident in MFT". I would like to know what this means and if these files are or should be deleted?

[Whiteshark]

From the pinned "Tips and Hints" topic:

 

What types of files can't Recuva securely delete?

There are 2 types, Files that are resident in the MFT and files of zero size. Resident files are very small files (typically a few hundred bytes) that are so small Windows stores them directly in the MFT. Zero byte files are exactly that, they have no size and therefore have nothing to delete.

 

[Aeneas]

From the pinned "Tips and Hints" topic:

 

What types of files can't Recuva securely delete?

There are 2 types, Files that are resident in the MFT and files of zero size. Resident files are very small files (typically a few hundred bytes) that are so small Windows stores them directly in the MFT. Zero byte files are exactly that, they have no size and therefore have nothing to delete.

 

 

None of the files is of zero size. The types of file that are in the MFT and cannot be deleted vary. The majority appear to contain icons and are small, a few hundred bytes, but some are cookies.

My questions are

1) are the files in the MFT actually deleted from my hard disc by Recuva or CCleaner, even though the message says "not deleted"? The difference between these and other files on the hard disc being that they are not overwritten by Recuva or CCleaner? And therefore easily revoverable?

2) even if these files are not overwritten by Recuva or CCleaner will they eventually be overwritten in the normal course of use of the computer?

3) can you tell me why some files are written to the MFT and others not. Is it random? Or are there some criteria which determine why this happens to certain files?

4) if cookies are resident in the MFT do they continue to operate as cookies after deletion with Recuva or CCleaner

5) is the delete operation of Recuva essentially the same as CCleaner?

[Augeas]

1) CC will (if the option is chosen) overwrite files in the MFT and anywhere else, and rename them to ZZZ.ZZZ. This is because it can do the overwriting and renaming before deleting. Recuva cannot overwrite or rename already deleted files which are resident in the MFT because it is unable to modify deleted MFT entries. The files in the MFT are deleted from a normal Explorer point of view just as other deleted files are, but are never actually 'deleted' from the disk. Deleted files in the MFT can be recovered, overwritten or not.

 

2) Yes, in the majority of cases. If you have a file right at the furthest extension of the MFT, and there are plenty of available slots before that, then it may be some time before it it overwritten, if ever. If you have a particularly nasty file you want to be overwritten, just don't cleanup until it goes.

 

3) Small files can fit into the MFT in their entirety. The MFT does not separate file header info from data, so if it can fit into the MFT entry then it will (can't remember tech MFT details at the mo). Larger files will use sectors on the disk outside of the MFT zone.

 

4) No. If a file entry in the MFT is flagged as deleted it will be handled as deleted, i.e. ignored. Another cookie or whatever will be created, maybe even in the same MFT slot!

 

5) Yes and No. CC will, as mentioned in 1), rename, overwrite and delete any file, just as anyone can. Recuva can overwrite any non-MFT files, but it can't rename them because it can't modify the MFT entry. The actual data overwrite option is identical, that is zeroes or whatever option you chose.

[Aeneas]

1) CC will (if the option is chosen) overwrite files in the MFT and anywhere else, and rename them to ZZZ.ZZZ. This is because it can do the overwriting and renaming before deleting. Recuva cannot overwrite or rename already deleted files which are resident in the MFT because it is unable to modify deleted MFT entries. The files in the MFT are deleted from a normal Explorer point of view just as other deleted files are, but are never actually 'deleted' from the disk. Deleted files in the MFT can be recovered, overwritten or not.

 

2) Yes, in the majority of cases. If you have a file right at the furthest extension of the MFT, and there are plenty of available slots before that, then it may be some time before it it overwritten, if ever. If you have a particularly nasty file you want to be overwritten, just don't cleanup until it goes.

 

3) Small files can fit into the MFT in their entirety. The MFT does not separate file header info from data, so if it can fit into the MFT entry then it will (can't remember tech MFT details at the mo). Larger files will use sectors on the disk outside of the MFT zone.

 

4) No. If a file entry in the MFT is flagged as deleted it will be handled as deleted, i.e. ignored. Another cookie or whatever will be created, maybe even in the same MFT slot!

 

5) Yes and No. CC will, as mentioned in 1), rename, overwrite and delete any file, just as anyone can. Recuva can overwrite any non-MFT files, but it can't rename them because it can't modify the MFT entry. The actual data overwrite option is identical, that is zeroes or whatever option you chose.

 

Thank you for going to the trouble of answering all my questions. A few points I don't quite understand.

Re 1. "CC will (if the option is chosen) overwrite files in the MFT". Do you mean that I can somehow ask CC specifically to delete and overwrite files in the MFT. Or is is the case that such files are automatically deleted by CC if I clean the appropriate drive?

Re 2. "..just don't use cleanup until it goes". I am not sure what this means.

Re 5. This raises two questions that have been on my mind.

a) I use CC to delete and overwrite temporary internet files on my C drive in 3 pass mode. Sometimes I then use Recuva to check how the deletion went. Frequently I find that files that I thought were deleted and overwritten are marked "excellent" or "good" for recovery. And in many cases the name of the file is readable (ie it is not obscured by zeros or zzzzs) Does this suggest that CC is not doing a comprehensive job of overwriting, (although the deleted file will often subsequently be overwritten by normal computer use)? Or am I missing some important instruction to CCleaner?

when I use Recuva like this (ie to check files deleted by CC) is it necessary, or a good idea, to use the Recuva delete function afterwards? I would imagine not since the mere fact of scanning my drive and bringing up the files should not alter their deleted status. But maybe you could confirm this.

[Augeas]

It's all down to the vagaries of the English language!

 

1) CC treats all files the same. All files have an entry in the MFT, the majority of the files will have the file data on the disk outside of the MFT zone which the MFT entry points to, and some small files will reside completely in the MFT. CC doesn't know the difference and just cleans what you've asked it to do, no matter where the files are. It's not possible to tell CC to clean or not clean the MFT only.

 

2) When a file is deleted its entry in the MFT is not removed but flagged as being deleted. These deleted entries are reused when new files are created. If you don't delete any files, either by not using CC or other software or simply not deleting them, then eventually all the deleted entries will be overwritten, so any embarrassing name will in time go. (Then you can clean up!)

 

5) I have never known CC to not rename or not overwrite a securely deleted file. CC will overwrite the file data of the current live version, there may well be older copies left over from edits, defrags, etc, as well as all the things that Windows does. I would not put too much importance on Recuva's guess at the state of the file, it's only software after all.

 

Just scanning with Recuva will not alter the state of the files. Whether you should secure delete them or not is up to you. Personally I don't bother except for a very few really important files (financial stuff and the like). I don't think that anyone is interested in the other 20,000 or so files. It's not worth getting paranoid, I doubt if I am of any interest to the rest of the world.

 

PS All this is only my guess how CC and Recuva works, probably the Piriform developers are sniggering up their sleeves.

[Aeneas]

It's all down to the vagaries of the English language!

 

1) CC treats all files the same. All files have an entry in the MFT, the majority of the files will have the file data on the disk outside of the MFT zone which the MFT entry points to, and some small files will reside completely in the MFT. CC doesn't know the difference and just cleans what you've asked it to do, no matter where the files are. It's not possible to tell CC to clean or not clean the MFT only.

 

2) When a file is deleted its entry in the MFT is not removed but flagged as being deleted. These deleted entries are reused when new files are created. If you don't delete any files, either by not using CC or other software or simply not deleting them, then eventually all the deleted entries will be overwritten, so any embarrassing name will in time go. (Then you can clean up!)

 

5) I have never known CC to not rename or not overwrite a securely deleted file. CC will overwrite the file data of the current live version, there may well be older copies left over from edits, defrags, etc, as well as all the things that Windows does. I would not put too much importance on Recuva's guess at the state of the file, it's only software after all.

 

Just scanning with Recuva will not alter the state of the files. Whether you should secure delete them or not is up to you. Personally I don't bother except for a very few really important files (financial stuff and the like). I don't think that anyone is interested in the other 20,000 or so files. It's not worth getting paranoid, I doubt if I am of any interest to the rest of the world.

 

PS All this is only my guess how CC and Recuva works, probably the Piriform developers are sniggering up their sleeves.

 

Well, I am sure if your observations or advice are incorrect Piriform will set me right! Many thanks. My main object is to understand how the systems work. It confirms my view that while cleaners and recovery systems are fine for personal users and can protect against casual snoopers they are unlikely to protect data from someone with sophisticated equipment.

[Augeas]

Spot on. Some users seem to want a foolproof data remover - I don't think that any cleaner is that.

[RoninV]

Just for some clarification. Though Recuva cannot recover zero-byte files, and unless a secure delete has been performed, will Recuva display the "correct" file name of zero-byte files that appear in the result list?

[Augeas]

Well, you could always have a look. Zero-byte file names are displayed, although most of mine are blank, or a number, or something unusual. I've never knowingly securely deleted a zero byte file (although I'm sure it must have happened) so I can't say what the result is.

[RoninV]

After reading the info on Recuva, I added it to my flash drive toolkit. From a forensic and/or recovery point of view, even if a file, in the Recuva result list, is zero-byte, the filename could come in handy. I'll give it a gander.

[fotophaker]

I guess I'm asking the same question a different way. I thought running CCleaner would clean all files like picture files off of my computer? But after running Recuva i can see the file and the picture. Are those recoverable? Also how can I tell if CC has securlty overwritten the file? Finally is there a way to "select all" to securely over write the files. Recuva came up with some 1400 files!!

 

 

It's all down to the vagaries of the English language!

 

1) CC treats all files the same. All files have an entry in the MFT, the majority of the files will have the file data on the disk outside of the MFT zone which the MFT entry points to, and some small files will reside completely in the MFT. CC doesn't know the difference and just cleans what you've asked it to do, no matter where the files are. It's not possible to tell CC to clean or not clean the MFT only.

 

2) When a file is deleted its entry in the MFT is not removed but flagged as being deleted. These deleted entries are reused when new files are created. If you don't delete any files, either by not using CC or other software or simply not deleting them, then eventually all the deleted entries will be overwritten, so any embarrassing name will in time go. (Then you can clean up!)

 

5) I have never known CC to not rename or not overwrite a securely deleted file. CC will overwrite the file data of the current live version, there may well be older copies left over from edits, defrags, etc, as well as all the things that Windows does. I would not put too much importance on Recuva's guess at the state of the file, it's only software after all.

 

Just scanning with Recuva will not alter the state of the files. Whether you should secure delete them or not is up to you. Personally I don't bother except for a very few really important files (financial stuff and the like). I don't think that anyone is interested in the other 20,000 or so files. It's not worth getting paranoid, I doubt if I am of any interest to the rest of the world.

 

PS All this is only my guess how CC and Recuva works, probably the Piriform developers are sniggering up their sleeves.

[Augeas]

I would think that the software, and possibly our knowledge, has improved in the two years since this topic was started.

 

CC will delete all the files you've asked it to, in whatever delete mode you've chosen. Run Analyse and expand the list to see what's being deleted.

 

In normal mode CC will just delete those files as if you'd done a shift/del: in secure delete mode it will overwrite the filename and data.

 

There may be other deleted copies of the files on the disk created by edits etc. CC will not touch these and they may be recoverable.

 

When CC securely deletes a file it renames it to ZZZ.ZZZ and overwrites the data with zeroes.

 

In Recuva check the box at the top l/h of the list to select all files. You need to be in list view to do this.