Recuva advanced overwrite options

Recuva
1

Hello!

I am back and learning alot, so, thank you for all of your input.

Question:

I noticed that under the advanced settings there is an option to have the files that Recuva has found overwritten if they have not already been so. I have my CCleaner set to do a simple one time overwrite, however, under the Recuva options I am able to ask for Gutman (35 times overwrite). I checked the first box which auto checked all of the boxes down the page and selected the Gutman overwrite. Nothing happened. I tried checking only one item - same thing - nothing happened. I tried doing the simple one time overwrite - nothing happened. I must have missed a step in the proceedure. Can anyone out there clue me in? I am a step by step kind of guy, so, a step by step answer would be most appreciated.

I sincerely thank you for your time and trouble,

Youngbear

2

Hello again, YB. Set your display to List View, if you haven't already. After checking the files you wish to be overwritten, right click with that cute little mouse pointer hovering somewhere in the left-hand display panel. You should then get a selection box with quite a few options shown, one of which (the last) is Secure Overwrite Checked. Just click on this. You will be asked if you really want to do this, say Yes. Then you will see some action.

You can highlight files to be deleted, but they have to be a contiguous bunch, and that cute etc. has to be hovering over the highlighted filenames to be effective.

It's your pc, and your life, but I would do a simple one-pass overwrite of zeroes. It's the fastest method and is quite effective. My post count would be halved if Gutmann had kept his mouth shut.

3

Thank you!

I took your advice, but I still would like to know how to get the Gutman overwrite just because I'm a control freak.

Thanks again, your friend,

Youngbear

4

Just open the Options box and select Gutmann in the Secure Overwrite section. Click OK, then do all the above.

P.S. All the above refers to Advanced Mode, as I don't use the run Wizard. It's more or less the same anyway.

5

Well, now I'm at a complete loss!

I followed your instructions and got the Gutman overwrite (I know this because it took over an hour vs. six minutes). And as usual the majority of the files turned from green to red. However, no matter the color, some files stated that they were not recoverable, others stated that they were excellent, some stated overwritten and some not. I tried to recover a sampling of all types, and they all recovered.

Next morning, went into recuva and ran the wizard the exact same way as yesterday and it found the exact same files from the first to the last, and they were - most of them - green, no overwrite, and excellent. I know I accomplished the overwrite because my system spent an hour doing something as the progress bar inched along.

This mystery leaves me with two questions:

1) Why were the circles to the far right red after yesterday's overwrite, but green this morning after a repeat search?

2) If I overwrote the files and they were marked not recoverable, or even not recoverable but no signs of an overwrite, why was I able to instantly recover them?

I am very confused, but not ready to give up. It must be something I am doing or not doing. By the way, I also tried uninstalling and reinstalling the Recuva program. I also tried running the application from my E drive as well as my C drive, and recovering from one drive to the other as well as recovering to the same drive.

The recovery area of the program is beautiful! It works no matter what! However, the overwrite area of the program and descriptions of a file not being recoverable simply escape me.

As always, I appreciate the time and trouble for your help and anyone else out there that has any ideas for me. What am I doing wrong?

Your friend,

Youngbear :o

6

It may be a misinterpretation of the word 'recoverable'. Recuva (in normal scan mode) will scan the MFT and return a list of file names from MFT entries which have been flagged as deleted. (No MFT entry is ever removed, just reused.) These entries still point to areas (clusters) on the disk that originally contained the file data. Recuva's secure overwrite option will overwrite the clusters that the entry in the MFT points to. The filenames and path info will remain, as Recuva is unable to overwrite MFT entry info. So a second scan of Recuva will show more or less the same list of filenames as you had before.

After doing all this overwriting, all of the files can still be recovered. More correctly, the data in the clusters that the MFT entry points to can be recovered. The recovered data will however be rubbish, as it's been overwritten. So yes, you can recover them all but you shouldn't be able to recover a valid file. Except...

The clusters that the (deleted file) MFT entry points to are legitimate areas to be used for new files to be created. So you could have a deleted MFT entry and an undeleted MFT entry pointing to the same space on disk. Recuva will not overwrite the valid data of the new file. However if you attempt to recover the deleted file you will actually get data from the new file. Confusing, eh?

You will also see small files (under 1k) that can't be overwritten. This is because they fit entirely into the MFT entry, with no clusters elsewhere on disk. As Recuva can't overwrite MFT entries it cannot overwrite these files.

I would not put too much faith in the good file/bad file indicators, especially if you run Recuva later, as you have done. I'm not sure how Recuva determines whether a file is recoverable or not, but it appears to be more an art than science. The test is whether the original data can be recovered. Keep testing.

7

Augeas, my friend! :rolleyes:

"The test is whether the original data can be recovered."

Man, that cleared up a lot! I'm feeling very stupid about now; because after reading your learned reply I tried going into a recovered file using MS Word to open it - gobbledy-gook! All I have been recovering are headings or titles or arrows pointing to a file that is useless.

On the one hand, I should have taken the time to go into the file before. However, if I had, I wouldn't have garnered the detailed answer that you provided. I do know that the MFT is a master file and one of its jobs is to keep itself from being fragmented, so, of course, some of the files will not allow themselves to be overwritten, but I could not put the entire picture together. I thank you very much and I consider the case solved.

I do want to mention to any member of the technology team responsible for Recuva that the area we've just covered over the last two days may be confusing for others, and it might be very helpful if a note of explanation such as the one I just received from you were worked into the program notes. Perhaps even a small re-design of code that replaces the previous headers/titles with a generic arrow "file fini!" until the system reads that the space has actually been reused with a new header/title.

Again, thank you so much.

Youngbear