AFAIK when running Wipe Free Space on a partition or HDD, Recuva will show files and folders all 'Z's, like in the attachment.
That was the case in the past.
I have run Wiper 3x now, even formatted the partition and again wiped it using CCleaner, but filenames are displayed with status 'Excellent' whilst using Recuva Deep Scan.
How come?
Thanks.
CCleaner v5.40.6411 x64
I would really be interested in hearing an answer to this. I depend on CCleaner to wipe files when I execute that command. Why would it work on a drive for hours then leave the files so that they could be recovered?
A question: Were you actually able to recover the files?
very small your files... are all your files with 712 bytes?
Probably they are not recoverable. However, the matter is that Wipe Free Space used to change the MFT records to all 'Z' entries. That was great.
Right now, even though files may not recoverable, the full names and paths may reveal what they were about, i.e. what the contents might have been.
See example. Ignore the filenames - they do not actually exist, but are for testing purposes only.
I really wouldn't know why it does not work this time. As said, I repeatedly tried.
Hmm.. whilst writing, I just come think of it: it is a partition, not an entire drive, that's the reason maybe...?
Are you using Drive Wiper or Wipe Free Space from Options/Settings? And what version of CC?
I use Tools->Drive Wiper, then select the drive (in this case partition) and at 'Wipe' Free Space Only is selected.
Probably I am doing something wrong or some setting is wrong, I don't know.
I am very sorry for the big screenshots! I tried to upload using an url from imgur, but nothing happened (spinning wheel)
Other type of URL, did not work, so I have no alternative but to upload it this way. Don't see a way to upload it as thumbnail only,
expanding to full size when clicked on.
As said, probably it may not work when used on a partition only.
Everything's a partition in Windows, so don't worrry about that.
The pic in post 1 shows entries in the MFT after they have been wiped, that is after enough 712-byte files have been allocated to overwrite all the free records in the MFT, and then deleted. Drive Wiper runs a wipe MFT before the wipe free space, so you should have seen a Wiping MFT message first.
It's very likely that there will be some 'deleted' records in the MFT, whether ZZ's or other names. That's what you see with a normal scan (and also with a deep scan, as a normal scan is run first). If you don't see any results with a normal scan, then:
1) So many new files have been allocated that the MFT is full and is now creating new records for new file allocations, i.e. there are no deleted records in the MFT.
2) There is something in the file/path filter box in Recuva, and nothing corresponding to this filter is found.
3) The option in Recuva to show securely deleted files is unchecked, and somehow Recuva can identify those ZZ files as securely deleted (maybe a specific file header?).
The screenshot in post 4 is confusing, as file and folder names are only held in the MFT, unless Recuva is digging them up from somewhere I am unaware of.
I have found a problem with WFS, in that in a drive that has a lot of fragmented free space (although the live files themselves may not be fragmented) some of the smaller space allocations are missed. This might be your case as the file sizes are relatively small. To get rid of them use Recuva's overwrite. This won't get rid ofthe file names, but as I don't know where they're coming from I can't really suggest anything else.
I did some other tests as well:
1) Wipe Free Space on a VM - then Recuva, same results
2)
(again) Formatted Q-partition (5GB test partition)
Wipe Free Space on this formatted Q-partition
Recuva - same results.
Wiping, by the way, takes just a minute... whereas I am used to taking quite a long time.
So it -looks- as if something is not done(?)
Anyway, in the past all were 'ZZ' but right now everything is 'revealed'.
Am curious how things show up with you or others.
Or should I use Wipe Entire Drive?
FWIW.. one last remark:
I used How To Use the Format Command to Write Zeros to a Hard Drive
found on Lifewire, viz. format x: /fs:NTFS /p:2 from the admin cmd prompt, where 'x:' is the driveletter.
The time it took was roughly the same as that of Wipe Free Space within CCleaner.
This time CCleaner couldn't find anything.
See screenshot.
Again, just FWIW
(obviously this only works for an empty drive/partition)