Can't securely delete filenames?

[Reverend Blue Jeans]

According to Recuva's documentation (under "Secure file deletion"):

 

"Note: When CCleaner securely deletes files, it renames them with all Zs in the file name (for example, ZZZZZZZZ.ZZZ) for increased security. Since Recuva is recovering files that have already been deleted, it cannot change their names before it overwrites them."

 

Huh?  I don't understand that.  Can someone explain that to me?

 

(I'm not really interested in recovering files anyway.  I just want to completely, permanently delete them -- filenames and all.   I don't see why Recuva apparently can't overwrite filenames the same way it overwrites the file data itself.  Especially if, as the documentation implies, CCleaner is apparently able to do so.)

[Augeas]

CC can change file names because it can rename them before deletion, in the same way as any user can. Recuva (and any software running under Windows) can't rename a deleted file nor amend the file name in the MFT as the file system will not allow access to protected metafile data.

[login123]

Questions about this situation, if I may.  

 

Say I have 2 files, called SecretRecipe.doc and PearPudding.jpg.  After I run CCleaner to securely delete them,   

1. will the new file names be all ZZs?  

2. will CCleaner overwrite the MFT entries for them?

3. will the MFT still contain any sort of entries for them? 

4. could rival chefs could possibly recover details of the files by accessing the MFT?

5. could rival chefs discover that these files were once on this computer by accessing the MFT?  

 

  <  joke alert   >  I firmly believe that the only way to REALLY delete a file is to shoot the hard drive into the sun, move to another country, assume a new identity, and undergo plastic surgery.  < end joke >

 

Still, my question is not interested in the many other methods windows uses to remember, just the file itself and the MFT, as modified by CCleaner.  

 

Thanks.  

[Augeas]

As far as my knowledge as a user goes...

 

1) Yes, some variable combination of ZZZ's and dots with no extension type.

2) Yes the filename is overwritten and the attribute size modified to suit the new file name, and the following attributes moved up or down to suit. The entry (filename, size, access date etc) for the file in the containing folder is overwritten on deletion by the following (in name sequence) file names being moved up, or by an end of file marker if it was the last file in the directory.

3) I doubt it. Possibly there are some very unusual circumstances where this could happen, but most likely no.

4) Same as 3

 

This is of course CC's secure file deletion. If you open a file, change the contents to zero, save it, rename it to ZZZ.ZZZ.ZZ and then delete it, that's what CC's sec del does,

 

As NTFS is a transactional file system there will be an entry in the journals for the edit, rename and deletion, so some info can be extracted from there. But the journal is cyclic so the data will be overwritten eventually, and you'd have to be very mean to do that.

[login123]

Thanks, Augeas. 

[Reverend Blue Jeans]

This is confusing.  Please forgive my ignorance (and my persistence!) but I think the Recuva documentation needs to be better-written, better organized, better-explained, and better-coordinated with CCleaner’s documentation.

 

Augeas says “CC can change file names because it can rename them before deletion, in the same way as any user can. Recuva (and any software running under Windows) can't rename a deleted file nor amend the file name in the MFT as the file system will not allow access to protected metafile data.”

 

Not really sure why if Recuva can recover a deleted file, it can’t also rename it. 

 

But what's really confusing is that it appears that CCleaner both CAN and CANNOT securely delete filenames and/or files that have been deleted:

 

On one page of Recuva’s documentation, it says “Secure overwrite [in Recuva] does not affect file names, which continue to exist in the MFT (Master File Table).  In order to overwrite names of deleted files, please use the Wipe MFT Free Space option in CCleaner.”  (http://www.piriform.com/docs/recuva/using-recuva/advanced-mode/securely-overwriting-your-files)

 

And in CCleaner's documentation, it says “For privacy and security reasons, you can set CCleaner to wipe the free areas of your hard disk so that deleted files can never be recovered.” (http://www.piriform.com/docs/ccleaner/using-ccleaner/wiping-free-disk-space)

 

But then another page in CCleaner’s documentation says “CCleaner can only securely delete files which have not yet been deleted from the Recycle Bin.  If you have already deleted files insecurely (for example, using Windows Explorer), you can delete them securely using Recuva.”

 

WTF???

 

All I want to do is securely delete all my “deleted” files, including their filenames.  That’s it.  Why is that so hard?

[Augeas]

CC and Recuva use Windows API's to access and manipulate data. They do not try to do any dodgy editing of system files, or do anything that the user couldn't do his or herself, given the time and patience. That's why they are inherently safe to run.

 

I'm not sure what's confusing about post 2, I suppose I should have written 'the file system will not allow write access to protected metafile data.'

 

Recovering a deleted file and renaming it are two different operations. Recovering is copying from one set of clusters to another, which anyone with a hex editor or other software can do. Renaming is amending data in the Master File Table, for which there is no API and which - if attempted under Windows with a hex editor - is soon backed out by NTFS. If you want to open the device in some native mode and hack away at the MFT then you can, but not with Recuva.

 

The documentation in the last paragraph in green is confusing. It is saying, or trying to say, that CC can only securely delete files that haven't already been deleted by another method. The recycler reference is a red herring.

 

As for your last sentence it isn't that hard to overwrite all your deleted files and filenames (secure delete is just an overwrite, as we know). Just run CC's Wipe Free Space from Drive Wiper.

 

[login123]

I didn't think I was confused, but I was confused about that. 

 

Soooo,  . . . the central issue is whether the file has been "unsecurely" deleted from the recycle bin, right?

1. If it has not, CCleaner can securely delete it, that is "clean out the file", and change the file name, true?
2. But if it has, and the MFT contains a reference or the file itself, CCleaner can securely delete it, but not change the file name, true?

 

Please forgive my kibitzing, but since the topic is open and the inimitable Augeas is responding,  I thought I would increase my knowledge a bit, and maybe the OP's also. 

[Augeas]

I don't know how anything I write could possibly be considered confusing.

 

“CCleaner can only securely delete files which have not yet been deleted from the Recycle Bin.  If you have already deleted files insecurely (for example, using Windows Explorer), you can delete them securely using Recuva.”

 

I think that the writer of this gem is trying to cover the perception that files may have been 'deleted' but have in fact been sent to the recycler. Those 'deleted' files are still live but have been renamed and moved to a protected folder.

 

CC can only securely delete live files. If you chose CC's secure file deletion and check the Empty Recycle Bin box then the files in the recycler will be overwritten, the file name overwritten with ZZ's - and the file deleted.

 

Login... 1) If the file has been deleted from the recycler by any means then CC can't touch it (apart from WFS).

2) No, you need to use Recuva to overwrite the file data, or CC WFS to overwrite the file data and overwrite the MFT entry.

 

(There are too many split infinitives in this thread.)

[login123]

Aahhh, yes.  Well, I have a huge capacity for confusion.  I've gotten used to it.  

 

So it doesn't matter if that file is visible in a folder, in the recycle bin, or out in free space in bits and pieces. 

Either CCleaner or Recuva will delete it and its name, as well as can be done in the windows OS. 

 

I guess one could check to see if it worked by using Recuva or some other recovery software to recheck for traces of the file.

I have done that before, but for me it just isn't worth the time it takes. 

 

Now I understand more about how the process works, and hopefully Reverend Blue Jeans does too. 

Thanks again. 

 

And in the future I shall really try to carefully join all my infinitives. 

 

 

 

 

[quintas]

This is getting silly so I'd like to condense this question:  "CAN or CAN'T CCleaner or Recuva securerly delete the contents of the MFT file in a way that Recuva can never retrieve them, yes or no?  

[Augeas]

Your question is unanswerable. You say 'Can or can't', group CC and Recuva together, and expect an answer of 'Yes or no', which defies any reasoning.

 

The question has not actually been asked in this thread, just the reason why Recuva can't overwrite a file name when CC can, and that has been answered in post 2 onwards. To sum up what the OP stated, CCleaner secure file deletion will overwrite the contents of the MFT file record; Recuva Secure Overwrite will not overwrite the contents of the MFT file record.

 

So if one tried to answer your question it would have been Yes, and No,

[mta]

for me, just don't keep your porn stash or nudie pics on your PC.

[login123]

Apologies for my silliness. 

These are a serious questions from the OP and later from quintas.  

The questions are more complicated than they seem, not amenable to yes or no answers.

That's is why I tried to break them down into parts. 

 

Big picture: 

For me, I assume that anything on my HDD can be recovered given enough time and effort.

Ccleaner and / or Recuva will do a good job of deleting and obscuring obsolete files, as described above. 

But . . .

If the stakes are high enough, one must destroy the HDD. 

[quintas]

Your question is unanswerable. You say 'Can or can't', group CC and Recuva together, and expect an answer of 'Yes or no', which defies any reasoning.

 

The question has not actually been asked in this thread, just the reason why Recuva can't overwrite a file name when CC can, and that has been answered in post 2 onwards. To sum up what the OP stated, CCleaner secure file deletion will overwrite the contents of the MFT file record; Recuva Secure Overwrite will not overwrite the contents of the MFT file record.

 

So if one tried to answer your question it would have been Yes, and No,

Augeas, i went into CC's settings and checked off "secure file deletion", "MFT', "alternate data streams" and "cluster tips" then ran it. But afterwards when I run a Recuva scan the jpg's still show up in the right hand pane

Im going to try "Drive Wiper' tonight and see what happens.

[Augeas]

Thread closed so that we can follow one thread only - https://forum.piriform.com/index.php?showtopic=45889&hl=