jxSmVUYd Posted June 13, 2014 Share Posted June 13, 2014 Hello, I used "Wipe Free Space drives" and checked "Wipe MFT Free Space". I choose "Secure file deletion" and checked "Wipe Alternate Data Streams" and "Wipe Cluster Tips". Immediately after CCleaner finished I used Recuva and 21 files were found and recoverable. Why? Link to comment Share on other sites More sharing options...
Moderators mta Posted June 13, 2014 Moderators Share Posted June 13, 2014 did you actually recover those files and were they useable?, that is, if they were docs or pics for example, could they be opened? Backup now & backup often.It's your digital life - protect it with a backup.Three things are certain; Birth, Death and loss of data. You control the last. Link to comment Share on other sites More sharing options...
jxSmVUYd Posted June 14, 2014 Author Share Posted June 14, 2014 Yes, I recovered 21 files to an USB-stick, they were described by Recuva as uncorrupted and not overwritten. I recovered and can open all of them. - pictures: 16 - PDF: 4, The PDF-files are from 2009, 2010, 2011 and 2014 - DOC: 1, The Word-file is from 2010. I used Wipe Free Space twice and recovered these 21 files successfully twice. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted June 15, 2014 Moderators Share Posted June 15, 2014 Just to know what we're doing, you checked Wipe Free Space Drives in Options/Settings? you checked local disk c: (or whatever disk you're wiping), and Wipe MFT Free Space? you checked Wipe Free Space in Cleaner/Advanced? you then pressed Run Cleaner from the Cleaner page? the disk you are wiping is NTFS? Secure File Deletion, Wipe Alternate Data Streams, and Wipe Cluster Tips are not part of wipe free space and can be disregarded here. Link to comment Share on other sites More sharing options...
jxSmVUYd Posted June 16, 2014 Author Share Posted June 16, 2014 you checked Wipe Free Space Drives in Options/Settings? Yes. you checked local disk c: (or whatever disk you're wiping), and Wipe MFT Free Space? Yes, local disk d:. Yes: Wipe MFT Free Space. you checked Wipe Free Space in Cleaner/Advanced? Yes. you then pressed Run Cleaner from the Cleaner page? Yes. the disk you are wiping is NTFS? Yes. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted June 17, 2014 Moderators Share Posted June 17, 2014 It appears that you are running deep scan in Advanced Mode, and that the 21 files were all found during the deep scan. Can you let us know what is checked in Options/Actions, and is everything checked in Options/Drives? I'm surprised that nothing from the MFT is shown. Wipe MFT replaces real file names and info with dummy file names, but they should still be shown in Recuva. Link to comment Share on other sites More sharing options...
jxSmVUYd Posted June 17, 2014 Author Share Posted June 17, 2014 Options/Actions: only Deep Scan checked Options/Drives: Everything checked Link to comment Share on other sites More sharing options...
Moderators Augeas Posted June 19, 2014 Moderators Share Posted June 19, 2014 I am perplexed by this. As I posted above, why aren't the deleted files in the MFT being shown? Whenever I've run a wfs for testing (on a small device) the files that CCleaner uses to overwrite free space are visible using Recuva. Where are they? I don't know why 21 files are being listed by Recuva. They add up to around 1 mb, so it doesn't look like an odd cluster or two. I've run out of theories, and ideas. One last try, the D drive is an hdd? Link to comment Share on other sites More sharing options...
jxSmVUYd Posted June 19, 2014 Author Share Posted June 19, 2014 D is a logical partition on a hdd. Does this has any meaning: ATA Vulnerabiltiy Protection (BIOS)? I thougth that Wipe MFT Free Space means that the names of deleted files are wiped. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted June 19, 2014 Moderators Share Posted June 19, 2014 Unless there's some very clever way that CC works, the file names in the MFT are overwritten with dummy file names. So they're still there as valid file names, but of no use to anyone. Unfortunately, unless I have a brainwave, I've run out of ideas on this one. I'll try to rig up a spare drive to do some tests myself. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now