After Wipe Free Space Recuva still recovered files

Hello,

I used "Wipe Free Space drives" and checked "Wipe MFT Free Space". I choose "Secure file deletion" and checked "Wipe Alternate Data Streams" and "Wipe Cluster Tips".

Immediately after CCleaner finished I used Recuva and 21 files were found and recoverable.

Why?

did you actually recover those files and were they useable?, that is, if they were docs or pics for example, could they be opened?

Yes, I recovered 21 files to an USB-stick, they were described by Recuva as uncorrupted and not overwritten. I recovered and can open all of them.

- pictures: 16

- PDF: 4, The PDF-files are from 2009, 2010, 2011 and 2014

- DOC: 1, The Word-file is from 2010.

I used Wipe Free Space twice and recovered these 21 files successfully twice.

Just to know what we're doing,

you checked Wipe Free Space Drives in Options/Settings?

you checked local disk c: (or whatever disk you're wiping), and Wipe MFT Free Space?

you checked Wipe Free Space in Cleaner/Advanced?

you then pressed Run Cleaner from the Cleaner page?

the disk you are wiping is NTFS?

Secure File Deletion, Wipe Alternate Data Streams, and Wipe Cluster Tips are not part of wipe free space and can be disregarded here.

you checked Wipe Free Space Drives in Options/Settings?

Yes.

you checked local disk c: (or whatever disk you're wiping), and Wipe MFT Free Space?

Yes, local disk d:. Yes: Wipe MFT Free Space.

you checked Wipe Free Space in Cleaner/Advanced?

Yes.

you then pressed Run Cleaner from the Cleaner page?

Yes.

the disk you are wiping is NTFS?

Yes.

post-37591-0-63250700-1402939693_thumb.jpg

post-37591-0-70584200-1402939711_thumb.jpg

It appears that you are running deep scan in Advanced Mode, and that the 21 files were all found during the deep scan. Can you let us know what is checked in Options/Actions, and is everything checked in Options/Drives?

I'm surprised that nothing from the MFT is shown. Wipe MFT replaces real file names and info with dummy file names, but they should still be shown in Recuva.

Options/Actions: only Deep Scan checked

Options/Drives: Everything checked

I am perplexed by this. As I posted above, why aren't the deleted files in the MFT being shown? Whenever I've run a wfs for testing (on a small device) the files that CCleaner uses to overwrite free space are visible using Recuva. Where are they?

I don't know why 21 files are being listed by Recuva. They add up to around 1 mb, so it doesn't look like an odd cluster or two.

I've run out of theories, and ideas.

One last try, the D drive is an hdd?

D is a logical partition on a hdd.

Does this has any meaning: ATA Vulnerabiltiy Protection (BIOS)?

I thougth that Wipe MFT Free Space means that the names of deleted files are wiped.

post-37591-0-96329600-1403191022_thumb.jpg

Unless there's some very clever way that CC works, the file names in the MFT are overwritten with dummy file names. So they're still there as valid file names, but of no use to anyone.

Unfortunately, unless I have a brainwave, I've run out of ideas on this one. I'll try to rig up a spare drive to do some tests myself.