tawagoto Posted June 8, 2009 Share Posted June 8, 2009 I recently downloaded both CCleaner and Recuva. Recuva (run to look for documents only) showed MANY unrecoverable files and a few recoverable ones. I guess it's fine that they're unrecoverable, but the filenames evidently still exist somewhere. I then ran CCleaner, Wipe Free Space, Gutmann 35. I ran Recuva again. Same result: MANY unrecoverable files and a few recoverable ones. Is there any way to wipe away the traces of file names? Thanks. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted June 8, 2009 Moderators Share Posted June 8, 2009 A normal scan (not deep scan) of Recuva will show deleted file names held in the MFT. Slots in the MFT holding deleted file names are never removed, just overwritten when new files and directories are created. So there will always be something in the MFT slot for a deleted file. The common way of neutering the deleted file names is to allocate a number of new files with bland names which overwrites the MFT entries, then delete them. I've never felt the need to run CC wipe free space but I don't think it clears the deleted file names from the MFT in the manner just described. Unfortunately none of the wipe free space users has ever posted any info on this for some reason. Until they do, this might be the reason you're still seeing deleted file names with Recuva. That's assuming those file names are names you recognise, not 'fillers'. I wouldn't put too much faith into the file state, being recoverable or unrecoverable. All deleted files that can be found are recoverable to a greater or lesser extent, it's just that some have rubbish in them and some have the original contents. Poor old Piriform software is trying to make an educated guess at which is which. Gutmann overwrites do not apply to wipe free space - you get one pass of zeroes. There's a great swell of opinion on this forum that one overwrite is perfectly adequate, Gutmann is irrelevant. (All this assuming XP or Vista using NTFS) Link to comment Share on other sites More sharing options...
ident Posted June 8, 2009 Share Posted June 8, 2009 A normal scan (not deep scan) of Recuva will show deleted file names held in the MFT. Slots in the MFT holding deleted file names are never removed, just overwritten when new files and directories are created. So there will always be something in the MFT slot for a deleted file. The common way of neutering the deleted file names is to allocate a number of new files with bland names which overwrites the MFT entries, then delete them. I've never felt the need to run CC wipe free space but I don't think it clears the deleted file names from the MFT in the manner just described. Unfortunately none of the wipe free space users has ever posted any info on this for some reason. Until they do, this might be the reason you're still seeing deleted file names with Recuva. That's assuming those file names are names you recognise, not 'fillers'. I wouldn't put too much faith into the file state, being recoverable or unrecoverable. All deleted files that can be found are recoverable to a greater or lesser extent, it's just that some have rubbish in them and some have the original contents. Poor old Piriform software is trying to make an educated guess at which is which. Gutmann overwrites do not apply to wipe free space - you get one pass of zeroes. There's a great swell of opinion on this forum that one overwrite is perfectly adequate, Gutmann is irrelevant. (All this assuming XP or Vista using NTFS) very interesting aug, does this apply to eraser also? Only over written MFT not deleted. No fate but what we make Link to comment Share on other sites More sharing options...
Moderators Augeas Posted June 8, 2009 Moderators Share Posted June 8, 2009 Microsoft pages for both XP and Vista say that the MFT never releases deleted file slots, so the MFT never reduces in size, whatever application you use. I have read that there is some relative addressing used (i.e. slot 14, second row etc.) so that those free slots in the MFT can't be reclaimed, but how true that is I don't know. NTFS is so complex, and finding digestible info about its workings is so difficult, that I can never be sure that what I say is correct. I'm sure that Piriform knows quite a lot, but aren't going to give any secrets away. I've no idea what Eraser does. Link to comment Share on other sites More sharing options...
tawagoto Posted June 11, 2009 Author Share Posted June 11, 2009 very interesting aug, does this apply to eraser also? Only over written MFT not deleted. I downloaded Eraser, Tolvanen's last version (http://www.tolvanen.com/eraser/) (there are newer versions developed by Tolvanen's successor). It has a setting to overwrite Master File Table Records. It worked --- at least I can't see the file names anymore after I run Recuva. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted June 11, 2009 Moderators Share Posted June 11, 2009 What happens when you set the Recuva options to show zero length files, and then run a scan? Link to comment Share on other sites More sharing options...
tawagoto Posted June 12, 2009 Author Share Posted June 12, 2009 What happens when you set the Recuva options to show zero length files, and then run a scan? Hmm... I didn't notice this before. It says it found 200,000+ files. They all have a filename like 00000000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000000000000000000000000000000000000000000000000000000000000000001D684. What are these? Every cluster on the drive? Anyway, the old filenames of mine are gone. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted June 12, 2009 Moderators Share Posted June 12, 2009 I assume they are the MFT entries (File Record Segments, as M/S calls them) that Eraser has overwritten and deleted. There does seem to be rather a lot, perhaps that's to do with the way that Eraser fills the disk to ensure that all old data is overwritten. But, as you say, the old filenames are gone. Still nobody who uses CC's wipe free space has posted what shows in a Recuva normal scan (the MFT) after wiping..... Link to comment Share on other sites More sharing options...
Recommended Posts