Jump to content

After Wipe Free Space Recuva still recovered files


Recommended Posts

Hello,

 

I used "Wipe Free Space drives" and checked "Wipe MFT Free Space". I choose "Secure file deletion" and checked "Wipe Alternate Data Streams" and "Wipe Cluster Tips".

 

Immediately after CCleaner finished I used Recuva and 21 files were found and recoverable.

 

Why?

Link to comment
Share on other sites

  • Moderators

did you actually recover those files and were they useable?, that is, if they were docs or pics for example, could they be opened?

Backup now & backup often.
It's your digital life - protect it with a backup.
Three things are certain; Birth, Death and loss of data. You control the last.

Link to comment
Share on other sites

Yes, I recovered 21 files to an USB-stick, they were described by Recuva as uncorrupted and not overwritten. I recovered and can open all of them.

 

- pictures: 16

- PDF: 4, The PDF-files are from 2009, 2010, 2011 and 2014

- DOC: 1, The Word-file is from 2010.

 

I used Wipe Free Space twice and recovered these 21 files successfully twice.

Link to comment
Share on other sites

  • Moderators

Just to know what we're doing,

 

you checked Wipe Free Space Drives in Options/Settings?

you checked local disk c: (or whatever disk you're wiping), and Wipe MFT Free Space?

you checked Wipe Free Space in Cleaner/Advanced?

you then pressed Run Cleaner from the Cleaner page?

the disk you are wiping is NTFS?

 

Secure File Deletion, Wipe Alternate Data Streams, and Wipe Cluster Tips are not part of wipe free space and can be disregarded here.

Link to comment
Share on other sites

you checked Wipe Free Space Drives in Options/Settings?

 

Yes.

 

you checked local disk c: (or whatever disk you're wiping), and Wipe MFT Free Space?

 

Yes, local disk d:. Yes: Wipe MFT Free Space.

 

you checked Wipe Free Space in Cleaner/Advanced?

 

Yes.

 

you then pressed Run Cleaner from the Cleaner page?

 

Yes.

 

the disk you are wiping is NTFS?

 

Yes.

post-37591-0-63250700-1402939693_thumb.jpg

post-37591-0-70584200-1402939711_thumb.jpg

Link to comment
Share on other sites

  • Moderators

It appears that you are running deep scan  in Advanced Mode, and that the 21 files were all found during the deep scan. Can you let us know what is checked in Options/Actions, and is everything checked in Options/Drives?

 

I'm surprised that nothing from the MFT is shown. Wipe MFT replaces real file names and info with dummy file names, but they should still be shown in Recuva.

Link to comment
Share on other sites

  • Moderators

I am perplexed by this. As I posted above, why aren't the deleted files in the MFT being shown? Whenever I've run a wfs for testing (on a small device) the files that CCleaner uses to overwrite free space are visible using Recuva. Where are they?

 

I don't know why 21 files are being listed by Recuva. They add up to around 1 mb, so it doesn't look like an odd cluster or two.

 

I've run out of theories, and ideas.

 

One last try, the D drive is an hdd?

Link to comment
Share on other sites

  • Moderators

Unless there's some very clever way that CC works, the file names in the MFT are overwritten with dummy file names. So they're still there as valid file names, but of no use to anyone.

 

Unfortunately, unless I have a brainwave, I've run out of ideas on this one. I'll try to rig up a spare drive to do some tests myself.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.