From what I can make of this, it appears that Recuva's overwriting file was created on top of another deleted file. That is quite normal, all deleted files are liable to be overwritten at any time. Also what you're looking at is the file directory and cluster chains, which in FAT file systems don't always represent the prior state of the clusters after file deletion.
Secure deletion is not usually effective on a flash device (it is not physically possible in nand flash), and multiple overwrites just compounds the problem.
"Were you just deleting one or two images, or an awful lot of them?"
- No, I was only deleting one picture, filename 2327.
"From what I can make of this, it appears that Recuva's overwriting file was created on top of another deleted file."
- I don't think so, because picture with filename 2256 wasn't deleted by me on windows neither with recuva, neither with camera. It is still on the sd-card.
I have researched on this toppic, perhaps recuva has the premium feature in it - that it is also able to overwritte slackspace / cluster tip area. This would be a positive thing and would make the secure erase more secure.
Thanks.
I have compessed the attachements to the demanded size.
picture with filename 2256 wasn't deleted by me on windows neither with recuva, neither with camera. It is still on the sd-card.
I have researched on this toppic, perhaps recuva has the premium feature in it - that it is also able to overwritte slackspace / cluster tip area. This would be a positive thing and would make the secure erase more secure.
Picture 2256 is shown on attachment 1 as a deleted file. The file Recuva uses to overwrite data is allocated by the file system (FAT16) and won't overwrite existing live files.
I think that the answer is that you are looking at two different files, one live which you can see on the sd card, and one deleted, which has the first 27 clusters overwritten. You would not be able to see the jpg with the first clusters being zero.
You have to take into account that you are not looking at the flash drive's clusters, but reading the drive's directory and FAT's, which are not necessarily the same thing.
Overwriting slack space is not relevant on a flash drive. I haven't tested whether it does so on an hdd.