Jump to content
CCleaner Community Forums
jxSmVUYd

After Wipe Free Space Recuva still recovered files

Recommended Posts

Hello,

 

I used "Wipe Free Space drives" and checked "Wipe MFT Free Space". I choose "Secure file deletion" and checked "Wipe Alternate Data Streams" and "Wipe Cluster Tips".

 

Immediately after CCleaner finished I used Recuva and 21 files were found and recoverable.

 

Why?

Share this post


Link to post
Share on other sites

did you actually recover those files and were they useable?, that is, if they were docs or pics for example, could they be opened?

Share this post


Link to post
Share on other sites

Yes, I recovered 21 files to an USB-stick, they were described by Recuva as uncorrupted and not overwritten. I recovered and can open all of them.

 

- pictures: 16

- PDF: 4, The PDF-files are from 2009, 2010, 2011 and 2014

- DOC: 1, The Word-file is from 2010.

 

I used Wipe Free Space twice and recovered these 21 files successfully twice.

Share this post


Link to post
Share on other sites

Just to know what we're doing,

 

you checked Wipe Free Space Drives in Options/Settings?

you checked local disk c: (or whatever disk you're wiping), and Wipe MFT Free Space?

you checked Wipe Free Space in Cleaner/Advanced?

you then pressed Run Cleaner from the Cleaner page?

the disk you are wiping is NTFS?

 

Secure File Deletion, Wipe Alternate Data Streams, and Wipe Cluster Tips are not part of wipe free space and can be disregarded here.

Share this post


Link to post
Share on other sites

you checked Wipe Free Space Drives in Options/Settings?

 

Yes.

 

you checked local disk c: (or whatever disk you're wiping), and Wipe MFT Free Space?

 

Yes, local disk d:. Yes: Wipe MFT Free Space.

 

you checked Wipe Free Space in Cleaner/Advanced?

 

Yes.

 

you then pressed Run Cleaner from the Cleaner page?

 

Yes.

 

the disk you are wiping is NTFS?

 

Yes.

post-37591-0-63250700-1402939693_thumb.jpg

post-37591-0-70584200-1402939711_thumb.jpg

Share this post


Link to post
Share on other sites

It appears that you are running deep scan  in Advanced Mode, and that the 21 files were all found during the deep scan. Can you let us know what is checked in Options/Actions, and is everything checked in Options/Drives?

 

I'm surprised that nothing from the MFT is shown. Wipe MFT replaces real file names and info with dummy file names, but they should still be shown in Recuva.

Share this post


Link to post
Share on other sites

I am perplexed by this. As I posted above, why aren't the deleted files in the MFT being shown? Whenever I've run a wfs for testing (on a small device) the files that CCleaner uses to overwrite free space are visible using Recuva. Where are they?

 

I don't know why 21 files are being listed by Recuva. They add up to around 1 mb, so it doesn't look like an odd cluster or two.

 

I've run out of theories, and ideas.

 

One last try, the D drive is an hdd?

Share this post


Link to post
Share on other sites

D is a logical partition on a hdd.

 

Does this has any meaning: ATA Vulnerabiltiy Protection (BIOS)?

 

I thougth that Wipe MFT Free Space means that the names of deleted files are wiped.

post-37591-0-96329600-1403191022_thumb.jpg

Share this post


Link to post
Share on other sites

Unless there's some very clever way that CC works, the file names in the MFT are overwritten with dummy file names. So they're still there as valid file names, but of no use to anyone.

 

Unfortunately, unless I have a brainwave, I've run out of ideas on this one. I'll try to rig up a spare drive to do some tests myself.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...