Jump to content

Recuva won't delete thumbnails


kandyman2017

Recommended Posts

I did a deep scan for all pictures and found several hundred thumbnails which I want to securely overwrite. However, when I select them and try to overwrite, I get the message
"Not overwritten - file is already overwritten with existing file(s)". I've tried either highlighting or checking them, but it doesn't make a difference. The thumbnails can't be deleted and I can even copy them to clipboard and paste them into Paint or Word or whatever. So the image still exists.

How can I securely remove these thumbnails such that the image will not be displayed even on a deep scan by Recuva?

recuva.JPG

Link to comment
Share on other sites

  • Moderators

It means what it says, that the clusters of the deleted file have been overwritten by a live file. What you are seeing are thumbnails (or whatever) from the live files. You can't overwrite these clusters, they contain live data.

I suspect that this is FAT32?

If it's NTFS you could run Drive Wiper. This will wipe the MFT and you will no longer get these messages.

By the way these messages are returned from the normal scan that a deep scan runs automatically as part of its process. Files found by the deep scan component (with a [001234].ext file name) will not, and can not, be overwritten by a live file.

Link to comment
Share on other sites

When you say 'live file', you mean a file that has not been deleted? So it can't delete the thumbnails because they are still on the drive somewhere. Is that what you mean?
Or do you mean that part of the deleted file is permanently gone because it has been overwritten but part has not? Sorry but I'm not clear on the process.

Yes it is thumbnails I am seeing. And it's those thumbnails I want to get rid of.

Link to comment
Share on other sites

  • Moderators

Yes, a live file is one that hasn't been deleted. The thumbnails belong to the live file that has overwritten the deleted clusters. They do not belong to the deleted file (if the deleted file has been completely overwritten, that is). If you look at the comment alongside the file you will see what is overwriting the deleted file, and in Advanced mode you can see whether some or all clusters have been overwritten.

You cannot get rid of anything that belongs to the overwriting file. It is live data.

Link to comment
Share on other sites

  • Moderators

That seems rather bizarre, that you should delete a live file because it has overwritten a deleted file. Don't you recognise the thumbnails? Is thsi FAT32? What is the name of the file that's overwriting these files?

Link to comment
Share on other sites

Perhaps I'm not explaining this correctly. Let me restate my problem:

1: I deleted pictures which are very personal in nature.
2: I ran a deep scan on Recuva to see if the pictures were 'really' deleted. Because I don't want the pictures to be recovered ever by anyone.
3: The scan showed thumbnails of the pictures I had deleted. 
4: I tried to securely overwrite the files which showed the thumbnails. But I got the error stated above.
5: I am left with the problem that private pictures (or thumbnails of them) can still be recovered. I don't want any possibility of them being recovered.

What is the next step?

Link to comment
Share on other sites

  • Moderators

Why make this more difficult than it needs to be? You should really abandon trying to use Recuva in this venture... ...in my opinion.

 

Let's make this easy and try what you're wanting to do with CCleaner by wiping the free space on the hard disk (if it's an SSD completely ignore these instructions):

1. Open CCleaner. In the Windows (tab) scroll down to 'Windows Explorer', right-click 'Thumbnail Cache' and select 'Clean Thumbnail Cache'

2. Still in CCleaner, now go into 'Tools > Drive Wiper', and select 'Free Space Only', 'Simple Overwrite (1 pass)', tick the hard disk, and then click the Wipe button. Note: Depending upon the hard disk size this can take hours to complete.

3. After CCleaner finishes restart the computer.

4. After the computer has started open Recuva to verify wiping the free space worked.

Link to comment
Share on other sites

  • Moderators

It isn't easy to describe a problem and it certainly isn't easy to diagnose one from a distance. It would help if you could answer the questions asked:

Is the file system FAT32 or NTFS?

In Recuva Advanced mode select one of the thumbnailed files and in the info panel on the right:

How many clusters are allocated to the file?

How many clusters are overwritten?

What is the name of the overwriting file?

P.S. Don't pick the 2mb file, pick something around 20k.

P.P.S. Confirm that the disk isn't an SSD, and isn't a shadow copy etc.

Link to comment
Share on other sites

  • Moderators

Did you wipe free space using Drive Wiper? Drive Wiper overwrites the deleted records in the MFT so Recuva should return a long list of null, or ZZZ.ZZZ file names. All these null files should be a few hundred bytes in size, and be contained in the MFT. There shold be no clusters allocated to them.

Are you still seeing the thumbnails? If you are, these should be found with a deep scan, and will have a numerical file name assigned instead of the actual filer name. These will not be overwritten by a live file, and can be securely deleted (which is just another overwrite).

If you are seeing the thumbnails, go to the Info panel as described above and post a screenshot of what is there.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.