Last night I executed a 'Wipe Free Space Drives' task using the 3-pass (US DOD 5220.22-M) option against an extra SATA disk (D:\). Once it was completed I loaded my forensics investigation project using EnCase. I created a snapshot of the ambient slack prior to the wipe and another following the wipe. The diiff revealed that while 1/3 of the actual deleted data was un-reconstructable in full, all the deleted file names were visible and 3/4 of 'wiped' deleted files were fully recoverable and viewable within the EnCase gallery.
Just to be certain, I tried another test disk and following the same procedures I received the same results.
I then executed another slack wiping utility (Eraser) against the first disk and interrogated the disk in EnCase and that program properly Zero'd out all the deleted files (including their original file names) and left the workstation in the proper, secure state.
