Maybe i'm not understanding how it's supposed to work. I have Recuva set to securely delete the files, and dont have the option enabled to show securely deleted files.
So I run a Recuva scan, have it securely delete whatever it finds, then when i run recuva again, it finds the same files again and overwrites them again.
Shouldn't it have already overwritten the files from the first time I ran it, so they shouldn't show up as needing to be overwritten again?
Assuming you're running a normal (not deep) scan: Recuva extracts file names and the data address from the master file table. When Recuva securely deletes files it overwrites the file data. It does not overwrite the file names in the MFT. So if you selected all the files Recuva found, securely deleted (overwrote) them, and then ran Recuva again it would find exactly the same list of file names as before.
Recuva uses Windows commands to overwrite file data. There is not a command to overwrite the file names in the MFT, which is why they remain.
If you're asking why does Recuva show these overwritten files when you have don't show sec del files selected, I don't know. I don't know what criteria Recuva uses to identify a securely deleted file as there is nothing to specifically identify such a thing, it's just a file of zeroes.
Ah ok, that makes sense. I just assumed that after Recuva overwrote the file data, it also overwrote the file name in the MFT somehow as well, so all traces of the file were gone.
So how does ccleaner do a "wipe mft free space" then, if there's no command to overwrite things in the MFT?
It allocates enough new files to fill all the unused records in the MFT and then deletes them. So the file names haven't actually gone, they've been replaced with nonsense names. So Windows, or more precisely the file system NTFS, does all the work.