Strange occurence while wiping free space?

Hello forum-goers,

I was running a 35-pass overwrite today (yes, I know it was unecessary; I just wanted to test) and it was scheduled to be finished in 2 days (as expected). However, it suddenly stopped at the 4 hour mark and said it was completed successfully (I have a 500 GB SATA HDD). I scratched my head but accepted it, happy that it finished that quickly. This was a test, so I used Recuva before the overwrite and took down names of 4 or 5 "Excellent" condition files that were ready to be recovered. I ran Recuva just now, after the apparent "success," but was met with the same files; all still ready to be recovered and all still in excellent condition. Why did this happen?

Regards,

CCleanerNoob

Wipe Free Space, I presume? Drive Wiper? How large are the 'unwiped' files?

I used the Drive Wiper option. The unwiped files are fairly small, the largest Excellent file was 500 bytes. The Largest unrecoverable-but-still-there file was 7000 KB

EDIT: It could have just been my cache (I did use my PC while it was running, no performance issues), but considering it stopped early I wanted to be sure.

Small files can remain residing in the MFT. Whenever I use Wipe Free Space (not the Drive Wiper) Recuva finds nothing.

Strange. Now on the topic of it stopping after two-three hours: was it an error? is my HDD unusually fast? should I redo?

no not an error, you are trying to call an estimated time (unreliable especially at the start of a process) an exact time, one will never equal the other and yes such a big difference is not unheard of, these statements are true for any application, not just ccleaner

Huh. I just figured it would take longer, especially since I've heard horror stories of a 35-pass taking up to 4 days once. Thank you for your help.

If you can still see the file names, and recover small files intact (under 800 bytes approx.) then it sounds as if the MFT hasn't been wiped. I was under the impression that wipe MFT was included in Drive Wiper. Could this operation have failed?

I tried running a 35-pass again and, like last time, ended early. This time, however, I monitored the progress. I kept refreshing my Start > Computer > OS screen to see how much memory was left/taken up by the overwrite. It got filled, then deleted the files (as expected), but the Drive Wipe stopped as well (after one fill). Did it really do a 35-pass complex overwrite? Because from just looks of it, my drive was filled once and then the program ended (which would be a single pass).

P.S. Recuva found 5 items again, but these were just Steam cache's and Local Data that was all listed as "Unrecoverable." The rest were the ZzzZz.... files that had just been made. So, I am pleased with that outcome.

If you can still see the file names, and recover small files intact (under 800 bytes approx.) then it sounds as if the MFT hasn't been wiped. I was under the impression that wipe MFT was included in Drive Wiper. Could this operation have failed?

Only if the option to do so is checked off in settings.

Did it really do a 35-pass complex overwrite? Because from just looks of it, my drive was filled once and then the program ended (which would be a single pass).

I have read in a forum post that a Free Space Wipe is only single pass.

I really truly believed that post so it must have been a moderator that wrote it :P

Nergal, in Drive Wiper (which the OP is using) there is no option to either wipe or not wipe the MFT. I understand that Wipe MFT is included.

Alan, your faith in the moderator's wisdom is touching. WFS from Options/Settings is one pass of zeroes. In Drive Wiper the user can request multiple passes, which is not the same as actually getting them. Multiple overwrites are nonsense anyway, so it's just confusing the issue.

It got filled, then deleted the files (as expected), but the Drive Wipe stopped as well (after one fill). Did it really do a 35-pass complex overwrite? Because from just looks of it, my drive was filled once and then the program ended (which would be a single pass).

I don't think that multiple passes fills the entire drive with one pass, deletes the files, then starts again on pass 2. Each file created would be saved to disk 35 times (or however many passes are requested) then on to the next file. So the disk would be filled once, in one 'pass' of 35 overwrites.

Oh, ok. Well, that makes sense. I must have ran so many drive wipes over the past few days (probably not the best thing for the life of my HDD...) to troubleshoot/test/see differences that even if the 35-pass didn't work (although I'm confident it did now), it wouldn't even matter :P

Thank you everyone for your help.

I'm using CCleaner with the Wipe Free Space function and Wipe MFT Free Space option.

The OS is Windows XP, with NTFS

I used the Wipe Free Space function on drive C.

Then I used [removed by moderation] on that same drive. [removed by moderation] has a recovery option where it scans every sector for directory & file data. The Wipe Free Space had removed many files but not all. Actually there were 10,842 files and 700 some odd directories [removed by moderation] found!

1. I was able to recover a TXT file and view its contents.

2. I was able to recover a 114KB EXE and run it.

Really hope this is not just a spam post about [removed by moderation].

Really hope this is not just a spam post about [removed by moderation].

I have cleaned that post up since we aren't supposed to allow it.

Sorry, I didn't realize that I shouldn't mention another software product. Let me try again:

I'm using CCleaner with the Wipe Free Space function and Wipe MFT Free Space option.

The OS is Windows XP, with NTFS

I used the Wipe Free Space function on drive C.

Then I used a file recovery program on that same drive. The recovery program has a recovery option where it scans every sector for directory & file data. The Wipe Free Space had removed many files but not all. Actually there were 10,842 files and 700 some odd directories the recovery program found!

1. I was able to recover a TXT file and view its contents.

2. I was able to recover a 114KB EXE and run it.