Saska Posted April 28, 2012 Share Posted April 28, 2012 A few months ago,i re-hashed several Excel files that i'd created,mostly to do with on-line banking & billing,none of these contained info.useable by anybody. I copied much of the old files onto the new ones & then used 'File Shredder' to shred the old files.I ran 'Recuva' to see what it could recover,& there were the file names of all the Excel files that i'd 'Shredded'. Ok,that's fine,the info. within the fies was gone - period !,but suppose one of the files was called 'My £ million bank account' ( i wish !),then the very fact that the file name remains,would indicate to a 'person' that i did indeed have a £ million bank account,something that i'd maybe wish to keep to myself. I did contact Piriform over this & they recommended that i run CCleaner's driver wiper using the Gutman process, to wipe the free space on the drive where the files had been kept. I did this a couple of days ago.It took close to 6 hours to run the driver wiper & at the end of it i ran Recuva to see if anything remained. Of the 6 Excel file names,5 had been wiped,but one still remained - how can that happen ??. The file location is given simply as H:\..... Personally, i feel that if all the information inc.file names isn't going to be 'wiped',then we should at least be given a file 're-name' function within 'Recuva'. It's the only criticism that i have of the Piriform software that i use,that 'private' info.can still remain after a supposedly 'secure' deletion. Link to comment Share on other sites More sharing options...
Moderators DennisD Posted April 28, 2012 Moderators Share Posted April 28, 2012 Hi Saska. Did you use the "Wipe Free Space" routine via "Tools\Drive Wiper"? If you access that feature via "Options\Settings", you have extra options including "Wipe MFT Free Space". Hope that helps, Link to comment Share on other sites More sharing options...
Moderators Augeas Posted April 28, 2012 Moderators Share Posted April 28, 2012 How could that happen (one Excel name remaining)? It could happen if Drive Wiper does not specifically wipe the MFT. Wipe Free Space in Options/Settings has an option to wipe the MFT. Drive Wiper does not. Does Drive Wiper wipe the MFT by default? I don't know as I don't use it, perhaps some other user can confirm one way or the other. If DW doesn't include wipe MFT, then its wipe free space operation will create new entries in the MFT, and possibly overwrite some of the Excel entries, leaving one by chance behind. If WFS had been used with wipe MFT checked then all the Excel entries should have been removed. I think that the advice should have been to use WFS in Options/Settings, with wipe MFT checked. This will give you one (much faster) pass of the drive. Wiping 35 times, a la Gutmann, is a waste of time. Link to comment Share on other sites More sharing options...
Saska Posted April 29, 2012 Author Share Posted April 29, 2012 Quote - "Wiping 35 times, a la Gutmann, is a waste of time" .Well,that's your opinion !. I'd previously tried the single & 7 pass driver wipes,that's why i contacted Piriform in the first place,neither of those wiped anything. As for 'did i wipe the MFT' - look at the title of this thread. Only when i'd used the Gutman process to wipe the MFT,did i get any result at all.That's why it's so very puzzling as to why one single file name should remain after all the other's have been wiped - they were all (presumably) in the same place,within the MFT. I agree that all the Excel entries 'should' have been removed,but they weren't - that's the problem. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted April 29, 2012 Moderators Share Posted April 29, 2012 And a happy Sunday morning to you too. No it's not my opinion. Disk manufacturers have spent hundreds of millions of pounds, or more likely billions of renminbi, on ensuring that whatever was last written to a disk sector is what is presented to the operating system when read. If you write one pass of zeroes to a sector then what you get when you read it is zeroes, never, ever anything else. If you're reading something else then it hasn't been overwritten: the number of overwrites is irrelevant. Is H the number of the drive you're overwriting? Is it a hd or flash or what? NTFS or FAT? The title of this thread tells me nothing. After a pretty extensive search I can find no definitive statement that CC's Drive Wiper option includes an MFT wipe. Do you know that it does? Link to comment Share on other sites More sharing options...
Moderators Andavari Posted April 29, 2012 Moderators Share Posted April 29, 2012 Try rebooting your computer after using the Wipe Free Space/Drive Wiper, and then see if Recuva still finds anything. Link to comment Share on other sites More sharing options...
Super Fast Posted April 29, 2012 Share Posted April 29, 2012 After a pretty extensive search I can find no definitive statement that CC's Drive Wiper option includes an MFT wipe. Do you know that it does? Not sure about him, but yes, I know that it does. Do a drive wipe, & it will begin the MFT wipe BEFORE it does the drive wipe. You just have to launch drive wipe first. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted April 29, 2012 Moderators Share Posted April 29, 2012 Right, it seems sensible that it would do a wipe MFT. What do you mean about launching drive wipe first? (I'll have to cadge a plug-in drive to test all this stuff.) Now we need to know what file system the o/p's drive is, and what actually happened. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now