Jump to content

Removing traces of previously deleted files


MAHEM

Recommended Posts

 

I'm trying to get rid of private files on a pc. A bunch I have removed with a shredder and some I have deleted just normally at an earlier time. I've ran Ccleaner to clean empty disk space.

 

Now when using Recuva, I can no longer even locate the files deleted with the shredder, but some of the previously "ordinarily" deleted files have left a trace. They appear to be unrecoverable according to Recuva, BUT I'm still seeing filenames which happen to be e-mail subjects, and Recuva is able to show tiny bits of the email header. Recuva also shows that these have been overwritten with other random files such as newer e-mails, so I assume windows has written over them when the space was needed. The file location shows C:\?\, so it seems like some sort of a trace. The files are 2-20kb each, all non recoverable but still somehow there because the original file name is shown.

 

Now onto my question: is there any way to totally remove these traces of the files? Without nuking the entire drive? Ccleaner obviously hasn't helped, and Recuva will not allow to securely overwrite them, I get a note saying "Not overwritten - previously overwritten by another file". So the file is gone, but the filename / trace is there.

Link to comment
Share on other sites

So I've ran Ccleaner drive wiper again (wipe MFT free space, secure file deletion, 1 pass), and I still have a ton of e-mail files showing up in Recuva.

 

They all show up as unrecoverable and owerwritten by another file, yet I was STILL able to partially (pretty much fully) recover a lot of them. These are all presumably files I've deleted old fashionedly, and windows has overwritten them over time. However I can still recover them.

 

Would running more passes help? Or does Ccleaner simply ignore these files if they are "seemingly" overwritten by other files? even if they are apparently not, because I can still recover them..

Link to comment
Share on other sites

  • Moderators

Are you running a normal or deep scan?

 

Did you wipe free space from Drive Wiper or Options/Settings/Wipe Free Space?

 

Do these files have an extension of .eml?

 

On my system my emails have an extension of .eml. They are individual files with a record in the MFT. If I wiped the MFT I would expect these files to be overwritten in exactly the same way as any other file. There are no special characteristics in the MFT for an eml file. A record in the MFT is either live or deleted, and deleted records can be overwritten with CC wipe MFT.

Link to comment
Share on other sites

I ran a deep scan

 

Have done drive wipe from both the Cleaner tab as well as seperately from Ccleaners Tools. in the options I've set the wipe to secure file deletion, and ticked alternate data streams, cluster tips and MFT free space.

 

I also ran Active@ Kill Disk, and the problem persists. For some reason these files which all appear overwritten in Recuva, will not be overwritten by ccleaner nor recuva or kill disk. Yet I can still recover them with Recuva. When I do so, on some I get a notice of partial recovery, on some it says it was not recover but in fact it was, I am able to open the eml file, and the files seem 100% recovered.

 

Any further ideas before I just wipe the entire hard drive? 

Link to comment
Share on other sites

  • Moderators

Secure File Deletion does not wipe the MFT, that is for the Wipe Free Space option. Either run a WFS, with the drive selected, Wipe MFT checked, and WFS checked in Cleaner/Windows/Advanced, or wipe free space using Tools/Drive Wiper (wipe MFT is automatic in Drive Wiper). From reading the above I don't think you've done the correct combination of checks to get a wipe MFT done.

Link to comment
Share on other sites

Sorry if I was unclear, but yes, I have done exactly what you mentioned, multiple times.

 

I wanted to try something: I deleted the entire folder where all these e-mails used to be. As I mentioned, according to Recuva, these files had been previously overwritten by other files which were newer e-mail (.eml) files in that same folder. Now, when I delete this entire folder including these new files (After backing it up externally), run wipe free space after that, finally Recuva finds no trace of the previously deleted files nor the new files which I now deleted.

 

It seems as if those new files overwriting the old (previously deleted) ones somehow prevented the traces from getting removed, if thats even possible...? 

 

Either way, now they seem to be unrecoverable as there is no trace after WFS. Now I ran a Recuva scan on the external drive which now contains the files, and it shows no recoverable files. So it seems like I've finally gotten rid of them. I don't even know how / why though, if some one has an idea, I'm curious to hear.

Link to comment
Share on other sites

  • 1 month later...

With all due respect, it shouldn't be this difficult to securely delete files.   And CCleaner should have a simpler interface so that users don't have to worry about whether they deleted files "this" way or "that" way, using "this" tool or "that" tool or "this" menu path or "that" menu path.  There should just be one simple, direct way of shredding files (including MFT entries) and that's it.*  And it should work.  (That is, make the files completely unrecoverable on the first try, period.)

 

______________________________

 

* (As opposed to, for example, the situation that Augeas describes: "Secure File Deletion does not wipe the MFT; that is for the Wipe Free Space option. Either run a WFS, with the drive selected, Wipe MFT checked, and WFS checked in Cleaner/Windows/Advanced, or wipe free space using Tools/Drive Wiper (wipe MFT is automatic in Drive Wiper). From reading the above I don't think you've done the correct combination of checks to get a wipe MFT done.")

Link to comment
Share on other sites

  • Moderators

It is easy to securely delete files, just switch the option on. It isn't the same as wiping free space, or wiping the MFT, which is what this thread is about. The complexity in my answer is because I tried to describe how both methods of wiping free space work. In practice the O/P was advised to use Drive Wiper, which is the 'simple, direct way of shredding files (including MFT entries)'.

Link to comment
Share on other sites

  • 10 months later...

I realize this is an old post but I would like to chime in here with a similar probem. I just cannot permanently delete my MFT jpg images using CC / Recuva. I've tried CC Wipe Free Space with MFT checked but the jpg's

still show up on the right pane with a standard Recuva scan.  I'm going to try Drive Wiper because some of you have said MFT is wiped automaticlly with that process. I'm not very optimistic though because from what I've been reading lately there seems to be no program out there that will effecetively delete MFT jpg's. Am I wrong?  Unless a program has been developed since that will do the job.  

Link to comment
Share on other sites

  • Moderators

Quintas, it's easier for all if we stick to one thread.

 

Drive Wiper will overwrite deleted file names in the MFT with a combination of ZZ.ZZZ's. None of these should show a preview.

 

Is Show Non-Deleted Files unchecked?

 

If you run Drive Wiper and can still see previews then post an uncropped snapshot of Recuva in Advanced Mode.

Link to comment
Share on other sites

Quintas, it's easier for all if we stick to one thread.

 

Drive Wiper will overwrite deleted file names in the MFT with a combination of ZZ.ZZZ's. None of these should show a preview.

 

Is Show Non-Deleted Files unchecked?

 

If you run Drive Wiper and can still see previews then post an uncropped snapshot of Recuva in Advanced Mode.

 

Thanks Augeas. I will try tonight. One last question, when you say is "Show Non-Deleted Files"  unchecked,  do you mean it has to be checked for the process to work properly?

Link to comment
Share on other sites

  • 10 months later...

I think I read somewhere in this forum that Recuva will have, in the future, the ability to wipe the MFT file names that no longer had files attached.  If so, please add me to the subscribers eagerly awaiting such an option.   Thanks.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.