Recuva Win2k Secure-Delete Prob

[thesingingdog]

Hi guys and gals!

 

Am using Recuva v1.41.537 on Win2k Pro SP4. It's saved my bacon a few times and works great but am having to sift through quite a lot of junk that CCleaner v3.11.1550 hasn't erased.

 

I see a lot of files marked 'unrecoverable' and some that are deleted and say 'recoverable' yet Recuva gives the message "Not overwritten - Cannot perform secure overwriting in Windows 2000 with cluster size greater than 4096".

 

My current file system is FAT32, Recuva is saying the cluster size is 16384.

 

Any ideas?

[Alan_B]

Am using Recuva v1.41.537 on Win2k Pro SP4. It's saved my bacon a few times and works great but am having to sift through quite a lot of junk that CCleaner v3.11.1550 hasn't erased.

Perhaps the latest version of CCleaner can Secure Erase your free space

My current file system is FAT32, Recuva is saying the cluster size is 16384.

So ?

That is consistent with a partition size 16,384 MB to 32,767 MB

http://support.microsoft.com/kb/192322

[thesingingdog]

Perhaps the latest version of CCleaner can Secure Erase your free space

 

So ?

That is consistent with a partition size 16,384 MB to 32,767 MB

http://support.microsoft.com/kb/192322

 

If I use CCleaner's drive wipe tool to clear the 'free space' on my Win2K Fat32 partition it still leaves heaps of recoverable (green light) files, even when they are greater than zero bytes. If my cluster size is normal why is Recuva not secure deleting the file?

 

I see CCleaner isn't listing Win2K in it's compatibility section but Recuva is, so it should work shouldn't it?

[Alan_B]

Recuva gives the message "Not overwritten - Cannot perform secure overwriting in Windows 2000 with cluster size greater than 4096".

 

My current file system is FAT32, Recuva is saying the cluster size is 16384.

Recuva is explicitly telling you that it cannot run under Windows 2000 AND ALSO perform what you want with a file cluster size greater than 4096,

hence it is impossible for it to do what you want on your cluster size of 16384.

16384 may be normal, but it is bigger than 4096.

 

The Recuva message implies that it is compatible with Win2K so long as this 4096 constraint is observed.

 

I believe Recuva was created for the purpose of Recovering files that had been deleted.

Secure overwriting was a later development at v1.10.223 (29 Jan 2008)

http://www.piriform....version-history

 

You seem to be wrong in saying "I see CCleaner isn't listing Win2K in it's compatibility section"

I can see

 

This includes both 32-bit and 64-bit versions of:

• Windows 7
  
• Windows Vista
  
• Windows XP
  

Additionally we're backwards compatible with older OSs:

• Windows 2000
  

http://www.piriform....cleaner-support

 

You have been using a very old version of CCleaner and the version history shows

v3.22.1800 (24 Aug 2012) Fixed support for Windows 2000.

 

I suggest you try a secure erase of free space with

v3.23.1823 (25 Sep 2012)

 

If that does not work for you then v3.24 should be ready next week

[Nergal]

If that does not work for you then v3.24 should be ready next week

next week-ish (releases come about 1/month, however neither Alan_B nor myself have foreknowledge of actual release date/time)

[thesingingdog]

Thanks guys.

 

I did upgrade to CCleaner v3.22.1800 when I started replying on this thread although the Tools>Driver Wiper>Full Erase feature now no longer works (says 'Disk is not ready' on external USB pens/SD cards) although the Free Space feature stills works.

 

'Dariks Boot And Nuke' would blitz the drive leaving only 20 files, I assume they are part of the partition process. CCleaner's Drive Wiper however leaves hundreds of file names, zero byte files and not-so-securely overwritten files even on a WinXP SP3 system using the secure-erase 35-pass feature.. I used the latest Recuva to do a comparison test.

 

I'm just making a suggestion as I have no right to complain about free software not working on a 13yr old OS, CCleaner has to be the finest piece of software ever. It's just not quite as deadly in the forensic department as DBan.

[Nergal]

I love ccleaner to death and I would never make the mistake of suggesting it over dBAN when it comes to security, and the developers never meant for it to be a replacement, nor forensic-proof.

 

Wipe drive is an afterthought of an afterthought for a feature that, I maintain, shouldn't be in the program.

I wasn't aware that dBAN left anything behind.

 

Also don't wipe SSD, FLASH,PENDRIVES it will kill them quickly

Also 3.22 is now old, 3.23 is current (with 3.24 due most likely the first week in November)

Edited October 22, 2012 by Nergal
added

[Alan_B]

Is this disc a HDD ?

Is it a secondary Internal or an external disc ?

 

Assuming that you burnt a Boot CD with 'Dariks Boot And Nuke' and booted into that,

then in theory it should not be able to leave 20 files intact.

 

Is it possible that the disc was perfectly erased,

BUT afterwards these 20 files were created during the "normal chaos" of a Windows 2000 boot-up/start-up/log-in process ?

 

N.B.

Windows XP onwards,

and very probably Windows 2000,

cannot live without creating a Recycle Bin on every partition it can lay its hands on

 

Using TreeSize Free I can observe that my secondary HDD partition D:\ holds

D:\$RECYCLE.BIN\S-1-5-21-4077350907-178761674-415728870-1000\Desktop.ini

D:\$RECYCLE.BIN\S-1-5-21-4077350907-178761674-415728870-1001\Desktop.ini

 

I observe that when I right click and select properties on each of these Desktop.ini files,

they are shown as zero bytes "created ‎10 ‎March ‎2012, ‏‎09:28:38",

and VERY surprised to observe that they have the status

Deleted ‎23 ‎October ‎2012, ‏‎08:42:59.

 

I deduce they were created when Windows was first installed and saw these partitions,

and every morning at start-up the old one is deleted / recreated and the newly created one is so inaccessible that even TressSize cannot see it until its "protection" is removed on the following start-up.

 

Windows is an enigma, wrapped up in a puzzle, wrapped up in a conundrum.