After working with a number of secure files, I decided (just last night) to use Ccleaner to wipe my hdd free space. I woke up this morning to a "success" message, which gave me a warm fuzzy. However, I realized that I needed just one more change to a particular secure file, so I edited it, tucked it gently back in its secure container, securely erased the folder that I was working in, and was happy. Then I started wondering if perhaps my text editor had created & deleted temp files and perhaps leaked some of my sensitive data. My warm fuzzy was starting to fizzle. So I downloaded Recuva and did a deep scan. Very much to my surprise, more than 41,000 deleted "files" were found. Looking through the scan results, I noted that some of these were more than two years old and contained text which quite positively identified the result -- such as log files from back when I was playing EVE Online. My warm fuzzy was entirely gone at this poiint!
Now when I did the disk wipe, I chose 1-pass overwrite. To my thinking, this should have been quite sufficient, as I'm not trying to evade the 3-letter agencies. Nevertheless, 41,000+ deleted "files" found! It appears that the Ccleaner wipe didn't do squat. I'm running Win 7 64-bit Pro. I was logged into an admin account when I did the wipe, but I did not specifically "run as admin" when I launched Ccleaner. Could this be the issue? I'm really quite disturbed about all this and would appreciate any clues about what's happening here.
EDIT: Acutally, it was more than 247,000 "files". I guess I didn't check the final tally. So yeah, a big number. As I type, Recuva is securely erasing the whole kaboodle. Hope I survive.
What did you use to wipe free space, the Options/Settings wfs or the Drive Wiper wfs? If Options/Settings then you need to have the check box in Cleaner/Advanced checked, and also the Wipe MFT box in Options/Settings.
If you are using Options/Settings and you haven't ticked the Wipe MFT box then the majority of the file names in the MFT will remain untouched. Small files (under 800 bytes or so) will also have their data content untouched.
One pass is fine. Hope Recuva survives overwriting 247k files.
Well, I canceled the secure deletion of 247k files in favor of another wipe attempt: Drive Wiper, not Options/Settings. This time I ran Ccleaner in "as admin" mode, followed by Recuva in "as admin" mode. Recuva showed only a handful of deleted files found this time, but something was amiss. Maybe I didn't check "deep scan" .. donno. Anyway, I ran Recuva again and found more than 391,000 deleted "files" with the deep scan. Of those, around 10% showed "excellent" for recovery, a couple were less than excellent, and the majority were non-recoverable.
Running without the deep scan produced 74, 103, or 13,000+ "files"..Seemed like a random choice of one of the three numbers. After another deep scan, I tried secure delete on 391,000+ files. Subsequent deep scans showed 389,000+ files, so the deletion may actually have done something, but not much.
At any rate, it seems clear that Drive Wiper doesn't do diddly. Very disappointing. To be clear, I'm talking about Drive Wiper, free space only, simple overwrite. Doesn't seem to do anything. Maybe these deleted files aren't considered free space? That would be weird.
Perhaps there's some misapprehension about how WFS works. All WFS can do is write data on top of what already exists, the term 'wiper' is a little misleading. Drive Wiper will run a wipe MFT by default. To do this it will create enough new files to fill all the records in the MFT that are flagged as deleted, then delete those files. So if you ran a Recuva normal scan and found 250k deleted files, ran Drive Wiper, and then ran Recuva again there would still be 250k files found, but with zapped file names and zeroes for data.
Excellent condition for recovery just means that the file is not currently overwritten by another live file. It can be recovered but the data will be zeroes.
After wiping the MFT the wfs will continue to allocate large files constructed from blocks of zeroes until the disk is full, then delete them. In this way all the free space on the disk is overwritten.
A Recuva deep scan will run the normal scan first, so you will see all the files from the MFT. It will then scan the disk cluster by cluster trying to indentify valid files by looking for file signatures in the data header. After the wfs those file signatures should be overwritten, and only the overwriting files should be found.
Well, I was seeing original data, enough to convince me that no overwrite had occurred. Granted, I may have made user errors in running the programs -- I know I did for Recuva; but nevertheless, I was unable to get the overwrites. I finally solved the problem by running "cipher /w:c:\" from an elevated command prompt. Thereafter, running a deep scan with Recuva showed only around 50 deleted files, comprised of a few system files with guid-like names and a bunch of mozilla/firefox stuff. No personal files.
I would do some more testing, but I feel like I'm wearing out my HDD. Anyway, I'm happy for now. Thanks for the replies, guys.