So I erased a bunch of files in a folder by right clicking on them and using Eraser, but I was able to recover all those files using a deep scan on that folder with Recuva. When I go into Eraser and click settings, under the default file eraser method, it says 35 Gutmann passes. This means that this is what it does to the file when you write click and use Eraser right? If this is the case, then how is Recuva able to recover all those files? I thought 35 Gutmann passes rendered a file pretty much unrecoverable. Could it be that it is not actually doing 35 Gutmann passes?
Who knows, why not ask at the Eraser forum?
What you're finding with a deep scan is most likely other copies of the files created by edits, saves, defrags, copies, etc. No file is recoverable after one overwrite by any software. Forget this obsession with multiple overwrites.
No file is recoverable after one overwrite by any software.
and you would support that with vital parts of your anatomy ???
Nevermind, I actually tried it again and realized that while the names of the files came up, it said the files were unrecoverable. But why is it that it finds the reference file? Is that easier to recover or something?
and you would support that with vital parts of your anatomy ???
Well, give or take a few caveats. After all we don’t know whether Elvis could be brought back to life in the future (or whether we would want to). Actually, cloning Elvis is possibly nearer to being achieved that recovering overwritten data using software.
But back to disks. A brief explanation of my anatomical confidence is that storage devices have, for many years now, been abstracted from the O/S (I love the word abstracted) and all the O/S can do is to send logical block address read and write commands to the disk controller. (And ‘secure overwrites’ are no different from any other writes.) When the controller is asked – nay, commanded – to read a certain number of sectors it will do everything in its power to do that. Disk manufacturers spend tens of millions to ensure that what is presented to the file system, and thus to the user, is absolutely, positively, precisely what was last written to the sectors. Not the last but one version, or some of it, or anything else. If a disk returns something else, that’s a sign that you need to throw it away.
As long as you’re using software and the file system is talking to the disk controller, you’ll never be able to read overwritten data. Nobody can do it. If it were that easy Piriform wouldn’t have developed Recuva. You can’t do it if you’re using something else to look at the disk either, but that’s another far longer story.
The caveat to this post is that it’s a post on a forum, with all the authority that carries.
Regardless of how effective an over-write may be
It may be possible that it was securely archived by NSA through a Windows Back-Door before it was deleted
I had asked a similar question in the recuva forum a long time ago, and someone told me the reason that Recuva still would find those file names but say it's unrecoverable is because in the MFT there was still a reference/pointer/something to the erased file, although Eraser did indeed make it not recoverable through Recuva, as you found out yourself.
Hope that helps too.
That could be true, depending on the secure delete process, but the OP was discussing a Recuva deep scan, which looks at the clusters not referenced by the MFT entries.