Jump to content

Wipe Free space not working?


ccw62

Recommended Posts

AFAIK when running Wipe Free Space on a partition or HDD, Recuva will show files and folders all 'Z's, like in the attachment.
That was the case in the past.

I have run Wiper 3x now, even formatted the partition and again wiped it using CCleaner, but filenames are displayed with status 'Excellent' whilst using Recuva Deep Scan.

 

How come?

Thanks.

CCleaner v5.40.6411 x64

2018-05-12_17-15-15.png

Link to comment
Share on other sites

I would really be interested in hearing an answer to this.  I depend on CCleaner to wipe files when I execute that command.  Why would it work on a drive for hours then leave the files so that they could be recovered?

 

A question:  Were you actually able to recover the files?

Link to comment
Share on other sites

very small your files...  are all your files with 712 bytes?

Versions of CCleaner Cloud; Introduction Ccleaner Cloud;

Ccleaner-->System-Requirements; Ccleaner FAQ´s; Ccleaner builds; Scheduling Ccleaner Free

 

Es ist möglich, keine Fehler zu machen und dennoch zu verlieren. Das ist kein Zeichen von Schwäche. Das ist das Leben -> "Picard"

Link to comment
Share on other sites

Probably they are not recoverable. However, the matter is that Wipe Free Space used to change the MFT records to all 'Z' entries. That was great.

Right now,  even though files may not recoverable, the full names and paths may reveal what they were about, i.e. what the contents might have been.

See example. Ignore the filenames - they do not actually exist, but are for testing purposes only.

I really wouldn't know why it does not work this time. As said, I repeatedly tried.

Hmm.. whilst writing, I just come think of it: it is a partition, not an entire drive, that's the reason maybe...?

2018-05-13_08-19-43.png

Link to comment
Share on other sites

I use Tools->Drive Wiper, then select the drive (in this case partition) and at 'Wipe' Free Space Only is selected.
Probably I am doing something wrong or some setting is wrong, I don't know.

I am very sorry for the big screenshots! I tried to upload using an url from imgur, but nothing happened (spinning wheel)
Other type of URL, did not work, so I have no alternative but to upload it this way. Don't see a way to upload it as thumbnail only,
expanding to full size when clicked on.

 

As said, probably it may not work when used on a partition only.

SnagIt-13052018 105924.png

Link to comment
Share on other sites

  • Moderators

Everything's a partition in Windows, so don't worrry about that.

The pic in post 1 shows entries in the MFT after they have been wiped, that is after enough 712-byte files have been allocated to overwrite all the free records in the MFT, and then deleted. Drive Wiper runs a wipe MFT before the wipe free space, so you should have seen a Wiping MFT message first.

It's very likely that there will be some 'deleted' records in  the MFT, whether ZZ's or other names. That's what you see with a normal scan (and also with a deep scan, as a normal scan is run first). If you don't see any results with a normal scan, then:

1) So many new files have been allocated that the MFT is full and is now creating new records for new file allocations, i.e. there are no deleted records in  the MFT.

2) There is something in the file/path filter box in Recuva, and nothing corresponding to this filter is found.

3) The option in Recuva to show securely deleted files is unchecked, and somehow Recuva can identify those ZZ files as securely deleted (maybe a specific file header?).

The screenshot in post 4 is confusing, as file and folder names are only held in the MFT, unless Recuva is digging them up from somewhere I am unaware of.

I have found a problem with WFS, in that in a drive that has a lot of fragmented free space (although the live files themselves may not be fragmented) some of the smaller space allocations are missed. This might be your case as the file sizes are relatively small. To get rid of them use Recuva's overwrite. This won't get rid ofthe file names, but as I don't know where they're coming from I can't really suggest anything else.

Link to comment
Share on other sites

I did some other tests as well:
1) Wipe Free Space on a VM - then Recuva, same results

2)
(again) Formatted Q-partition (5GB test partition)
Wipe Free Space on this formatted Q-partition
Recuva - same results.

Wiping, by the way, takes just a minute... whereas I am used to taking quite a long time.
So it  -looks-  as if something is not done(?)

Anyway, in the past all were 'ZZ' but right now everything is 'revealed'.
Am curious how things show up with you or others.

Or should I use Wipe Entire Drive?

 

 

SnagIt-14052018 085159.png

Link to comment
Share on other sites

FWIW.. one last remark:

I used How To Use the Format Command to Write Zeros to a Hard Drive

found on Lifewire, viz. format x: /fs:NTFS /p:2 from the admin cmd prompt, where 'x:'  is the driveletter.
The time it took was roughly the same as that of Wipe Free Space within CCleaner.
This time CCleaner couldn't find anything.
See screenshot.

Again, just FWIW

(obviously this only works for an empty drive/partition)

SnagIt-16052018 130045.png

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.