Jump to content

cwalt

Members
  • Posts

    7
  • Joined

  • Last visited

Posts posted by cwalt

  1. It's true that Recuva doesn't have the ability to delete files held in their entirety in the MFT. I understand that some disk washeres, such as Eraser, can overwrite these MFT entries. They do this by first filling the entire disk with large temp files, then allocating small temp files until the MFT is full, then deleting all they have created. They have to do this as the MFT never releases its used slots and never shrinks in size (in XP, not too sure about Vista).

     

    You can do this yourself by creating enough temp files of more than 1k in a series of temp folders so that eventually all the entries in the MFT will be allocated a dummy file name and the contents overwritten. (Keep checking with Recuva.) Then delete the lot. This is mimicking the disk washer techniques, but without doing the whiole disk. Of course you'll have to keep doing this as new files resident in the MFT are created.

     

    Or do what I do, ignore them.

  2. Using XP Home Edition. Scan produces picture files from IE Yahoo homepage. Secure Delete of Checked Files results in files that are not displayable but the File Name is still readable. Is it not possible to clear the Filename?

  3. Yorkshireman, I hope someone can answer the question you have posed. I have the same question.

     

     

     

     

    Well they are, for example, images that you would find in temporary Internet files left by IE ...which are meant to be securely deleted by CCleaner. Some have logical names and they are of a .gif or .jpg format.
  4. Hi Vince,

     

    Right. Do a scan with Recuva. Pick a harmless file, right click on it and select Secure delete Highlighted. There will be a Do You Really Want to do This box, select yes, and there will (should) be a Deleted 1 Files in 0.0x sec message.

     

    If you don't get this message then either you have highlighted one file with left click, or several with left click/shift, and then right clicked when the mouse is not over the highlighted area. The box will say Do You Really Want to Delete 0 Files, and indeed will not delete anything. Using the tick boxes instead of highlighting will solve this.

     

    If the files are small (1k) they may be resident in the MFT, in which case you can go through the motions but the final message will include Not deleted - File is resident in the MFT.

     

    You can not of course securely delete an undeleted file, if you have chosen to show these in your scan.

     

    Other mysteries are when the deleted file has already been overwritten, sometimes with a pic, so that it shows the pic that's overwriting it. You can secure delete the file, but it will still show the overwriting pic, as that is a live pic and won't be touched. However this won't be the cause of your 0 Files deleted message.

     

    That's about all I can think of at the moment. Champagne and orange juice awaits me (OK, Cava and oj, we're not that rich), so I'm off to indulge. Happy Christmas everyone, especially you insomniac Americans.

     

    I need further guidence on your statement, 'You can not of course securely delete an undeleted file, if you have chosen to show these in your scan".

    Can you only securely delete a file that has already been deleted by other means? If so, what other means?

    You can tell, I am really in waaayyyy over my head. Please help

  5. Not quite. If a secure deletion option is chosen in CC then the names of live files selected for deletion will be changed in the MFT to some variant of ZZZZ.ZZZ. If normal deletion is chosen then the file names will remain unchanged. Recuva does not, and I assume can not, change names of already deleted files in the MFT no matter what secure overwrite option is chosen. No names in the MFT are ever removed, they can only be overwritten.

     

    I just ran CC in the highest deletion option. It came back cleared on subsequent scans.

    I then ran Recuva and it still shows the file names even though it says that the data is overwritten & unrecoverable.

    I assume that I am doing something wrong but can't figure out what that may be.

  6. Recuva overwrites file data but does not remove the filenames from the MFT. Have a look at

     

    http://forum.piriform.com/index.php?showtopic=20089&hl=

     

    I have also tried to secure delete items and found the same to be true

    I then ran CCleaner to delete the items and when I ran Recuva the filenames were still there.

    I thought CCleaner would put zzzzs in the filename.

    This is the first time I have ever used these utilities so, even though I have read the info I may not be understanding it correctly..... Any help will be appreciated.

     

    Is it true that neither CCleaner or Recuva will remove deleted file names from the MFT?

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.