Secure Deleting picture 2327 overwrittes clusters of picture 2256

[HighTech]

Hello,

 

I'm using the latest version of Recuva.

 

I have deleted picture 2327 on SD-Card with using NSA-Method (today: 2014-05-03 10:49).

After that picture 2327 was secure deleted as I wanted (Header 0000000000000....).

 

But Recuva has created a file named UDYNUSPVMURZVWJR (I think in order to secure delete).

The other Picture 2256 on SD-Card, which I didn't want to secure delete, had been overwritten a few cluster by the UDYNUSPVMURZVWJR data?

 

The picture 2256 looks OK, but why does Recuva overwritte data of another file?

 

Please look at the attachements.

 

Thanks.

 

Best regards

HighTech

[HighTech]

Screenshots 5 and 6....

Edited May 5, 2014 by DennisD
Image links lead to pop-up's. Removed

[DennisD]

Obviously not intentional, but links removed for the reason stated.  

 

Were you just deleting one or two images, or an awful lot of them?

[Augeas]

From what I can make of this, it appears that Recuva's overwriting file was created on top of another deleted file. That is quite normal, all deleted files are liable to be overwritten at any time. Also what you're looking at is the file directory and cluster chains, which in FAT file systems don't always represent the prior state of the clusters after file deletion.

 

Secure deletion is not usually effective on a flash device (it is not physically possible in nand flash), and multiple overwrites just compounds the problem.

[HighTech]

So, thank you so far.

 

"Were you just deleting one or two images, or an awful lot of them?"

- No, I was only deleting one picture, filename 2327.

 

"From what I can make of this, it appears that Recuva's overwriting file was created on top of another deleted file."

- I don't think so, because picture with filename 2256 wasn't deleted by me on windows neither with recuva, neither with camera. It is still on the sd-card.

 

I have researched on this toppic, perhaps recuva has the premium feature in it - that it is also able to overwritte slackspace / cluster tip area. This would be a positive thing and would make the secure erase more secure.

 

Thanks.

 

I have compessed the attachements to the demanded size.

[Augeas]

picture with filename 2256 wasn't deleted by me on windows neither with recuva, neither with camera. It is still on the sd-card.

 

I have researched on this toppic, perhaps recuva has the premium feature in it - that it is also able to overwritte slackspace / cluster tip area. This would be a positive thing and would make the secure erase more secure.

 

 

Picture 2256 is shown on attachment 1 as a deleted file. The file Recuva uses to overwrite data is allocated by the file system (FAT16) and won't overwrite existing live files.

 

I think that the answer is that you are looking at two different files, one live which you can see on the sd card, and one deleted, which has the first 27 clusters overwritten. You would not be able to see the jpg with the first clusters being zero.

 

You have to take into account that you are not looking at the flash drive's clusters, but reading the drive's directory and FAT's, which are not necessarily the same thing.

 

Overwriting slack space is not relevant on a flash drive. I haven't tested whether it does so on an hdd.