Just wondering

[Augeas]

Whilst ever-vigilantly patrolling my pc I noticed that when I ran Recuva and listed the securely deleted files a few of them (OK, one or two) showed a quite intact jpg file - and the usual excuse, that the deleted file had been overwritten, was not true. So I tried to create a theory to fit the facts.

 

I wonder if a file was securely deleted by CC, and renamed to something like ZZZZ.ZZ, and showed zeroes using Recuva. Then the space it previously occupied was taken by a new file, the jpg. So looking at the ZZ file you would see the jpg, but also see that the file had been overwritten by the new live file.

 

Then the new live file is shift/deleted without secure overwrite. The ZZ file still shows the jpg, but doesn't say that it's overwritten, as it isn't any more. Both ZZ/jpgs on my pc were small, around 5 or 6 k, so there would be more chance to align the jpg on the old ZZ file sector.

 

It depends on whether Recuva only indicates that a deleted file is overwritten if the overwriting file is still live. Have I spent too long in the sun?

[davey]

Whilst ever-vigilantly patrolling my pc I noticed that when I ran Recuva and listed the securely deleted files a few of them (OK, one or two) showed a quite intact jpg file - and the usual excuse, that the deleted file had been overwritten, was not true. So I tried to create a theory to fit the facts.

 

I wonder if a file was securely deleted by CC, and renamed to something like ZZZZ.ZZ, and showed zeroes using Recuva. Then the space it previously occupied was taken by a new file, the jpg. So looking at the ZZ file you would see the jpg, but also see that the file had been overwritten by the new live file.

 

Then the new live file is shift/deleted without secure overwrite. The ZZ file still shows the jpg, but doesn't say that it's overwritten, as it isn't any more. Both ZZ/jpgs on my pc were small, around 5 or 6 k, so there would be more chance to align the jpg on the old ZZ file sector.

 

It depends on whether Recuva only indicates that a deleted file is overwritten if the overwriting file is still live. Have I spent too long in the sun?

Hi Augie,

I think you have some computer background if I am not mistaken.

Anyhow, you have definitely pointed out some of the complexities involved with the "wiping" or "secure deleting" of files.

I think the developers have been wise not to "wipe" versus "secure delete" and this leaves them open to undeserved criticism and questioning.

After all Recuva's main function is to "recover" data.

Just like in the example you have provided. You have discovered some of the things that have to be decided upon by the individual programmer and the team. Do you wipe the fact that a file was ever there or do you leave a little "note" behind ? It is possible that what you describe may have occurred but very unlikely. But I will never preclude the fact that it is possible and we all know Murphy and the rest. It is more likely that some "wiping" desires by users are just not possible. Unless of course you use more physical and violent procedures to do so.

 

So "stuff can happen" and "it will happen". It always does.

 

No,you haven't been out in the sun "too long". Maybe just long enough to visit the local pub and ponder some more mysteries.

davey

P.s. There is something going on recently on the forum. I believe it has been for the benefit of us all.

Many astute observations such as yours being made, discussed and resolved..

Such as this linked thread. http://forum.piriform.com/index.php?showto...4&st=0&