I'm attempting to use Recuva to reveal and / or recover files which have been wiped or over-written.
I first mounted a TrueCrypt volume and wiped multiple unencrypted files using the PGP Wipe function.
I then used BCWipe to overwrite file slack and free space on the entire volume with 35 passes of Peter
Guttman's algorithm. I then opened Recuva to view what remained.
I'll attach a screenshot of what was displayed. Note the 'Comment' column. All files shown ( partial ) were
wiped at the same time.
Should I expect or assume that those files _could_ be recovered by those _other_ than the 3-letter folks ?
Or is it some type of misinterpretation(s) of data by Recuva ?
I'd really appreciate any and all comments / solutions or suggestions.
--
Amalthea
I am pretty sure i heard one of the recuva devs say that it cannot recover files from formated hdds, im no expert in this, but im sure it would be easier to recover files from a formated hdd then securly overwritten files.
I am pretty sure i heard one of the recuva devs say that it cannot recover files from formated hdds, im no expert in this, but im sure it would be easier to recover files from a formated hdd then securly overwritten files.
Thanks User000, I appreciate your response.
Although I am still baffled ( not complaining ) that Recuva's 'State' column displays a files condition as 'Excellent' when it's obvious that file has been over-written and seems to be unrecoverable in full or in part.
Recuva looks for files that it can restore and does not make any judgement on the information those files contain.
The files you are trying to recover have been erased by overwriting each fragment multiple times, BUT they have not been over written by a different file (i.e an overlapping file), so technically the file is still intact as all the fragments are complete. It's like scribbling all over a jigsaw, the pieces are still the same shape and still join up, but you can no longer see the picture.
Recuva looks for files that it can restore and does not make any judgement on the information those files contain.
The files you are trying to recover have been erased by overwriting each fragment multiple times, BUT they have not been over written by a different file (i.e an overlapping file), so technically the file is still intact as all the fragments are complete. It's like scribbling all over a jigsaw, the pieces are still the same shape and still join up, but you can no longer see the picture.
MrRon
Now I understand completely. Thanks MrRon and I appreciate you taking the time to explain.