kandyman2017 Posted November 6, 2018 Share Posted November 6, 2018 I did a deep scan for all pictures and found several hundred thumbnails which I want to securely overwrite. However, when I select them and try to overwrite, I get the message "Not overwritten - file is already overwritten with existing file(s)". I've tried either highlighting or checking them, but it doesn't make a difference. The thumbnails can't be deleted and I can even copy them to clipboard and paste them into Paint or Word or whatever. So the image still exists. How can I securely remove these thumbnails such that the image will not be displayed even on a deep scan by Recuva? Link to comment Share on other sites More sharing options...
Moderators Augeas Posted November 6, 2018 Moderators Share Posted November 6, 2018 It means what it says, that the clusters of the deleted file have been overwritten by a live file. What you are seeing are thumbnails (or whatever) from the live files. You can't overwrite these clusters, they contain live data. I suspect that this is FAT32? If it's NTFS you could run Drive Wiper. This will wipe the MFT and you will no longer get these messages. By the way these messages are returned from the normal scan that a deep scan runs automatically as part of its process. Files found by the deep scan component (with a [001234].ext file name) will not, and can not, be overwritten by a live file. Link to comment Share on other sites More sharing options...
kandyman2017 Posted November 6, 2018 Author Share Posted November 6, 2018 When you say 'live file', you mean a file that has not been deleted? So it can't delete the thumbnails because they are still on the drive somewhere. Is that what you mean? Or do you mean that part of the deleted file is permanently gone because it has been overwritten but part has not? Sorry but I'm not clear on the process. Yes it is thumbnails I am seeing. And it's those thumbnails I want to get rid of. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted November 7, 2018 Moderators Share Posted November 7, 2018 Yes, a live file is one that hasn't been deleted. The thumbnails belong to the live file that has overwritten the deleted clusters. They do not belong to the deleted file (if the deleted file has been completely overwritten, that is). If you look at the comment alongside the file you will see what is overwriting the deleted file, and in Advanced mode you can see whether some or all clusters have been overwritten. You cannot get rid of anything that belongs to the overwriting file. It is live data. Link to comment Share on other sites More sharing options...
kandyman2017 Posted November 7, 2018 Author Share Posted November 7, 2018 So in order to get rid of those thumbnails, I have to find out where they are located and delete the live file, right? Link to comment Share on other sites More sharing options...
Moderators Augeas Posted November 7, 2018 Moderators Share Posted November 7, 2018 That seems rather bizarre, that you should delete a live file because it has overwritten a deleted file. Don't you recognise the thumbnails? Is thsi FAT32? What is the name of the file that's overwriting these files? Link to comment Share on other sites More sharing options...
kandyman2017 Posted November 7, 2018 Author Share Posted November 7, 2018 Perhaps I'm not explaining this correctly. Let me restate my problem: 1: I deleted pictures which are very personal in nature. 2: I ran a deep scan on Recuva to see if the pictures were 'really' deleted. Because I don't want the pictures to be recovered ever by anyone. 3: The scan showed thumbnails of the pictures I had deleted. 4: I tried to securely overwrite the files which showed the thumbnails. But I got the error stated above. 5: I am left with the problem that private pictures (or thumbnails of them) can still be recovered. I don't want any possibility of them being recovered. What is the next step? Link to comment Share on other sites More sharing options...
Moderators Andavari Posted November 7, 2018 Moderators Share Posted November 7, 2018 Why make this more difficult than it needs to be? You should really abandon trying to use Recuva in this venture... ...in my opinion. Let's make this easy and try what you're wanting to do with CCleaner by wiping the free space on the hard disk (if it's an SSD completely ignore these instructions): 1. Open CCleaner. In the Windows (tab) scroll down to 'Windows Explorer', right-click 'Thumbnail Cache' and select 'Clean Thumbnail Cache' 2. Still in CCleaner, now go into 'Tools > Drive Wiper', and select 'Free Space Only', 'Simple Overwrite (1 pass)', tick the hard disk, and then click the Wipe button. Note: Depending upon the hard disk size this can take hours to complete. 3. After CCleaner finishes restart the computer. 4. After the computer has started open Recuva to verify wiping the free space worked. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted November 7, 2018 Moderators Share Posted November 7, 2018 It isn't easy to describe a problem and it certainly isn't easy to diagnose one from a distance. It would help if you could answer the questions asked: Is the file system FAT32 or NTFS? In Recuva Advanced mode select one of the thumbnailed files and in the info panel on the right: How many clusters are allocated to the file? How many clusters are overwritten? What is the name of the overwriting file? P.S. Don't pick the 2mb file, pick something around 20k. P.P.S. Confirm that the disk isn't an SSD, and isn't a shadow copy etc. Link to comment Share on other sites More sharing options...
kandyman2017 Posted November 11, 2018 Author Share Posted November 11, 2018 Clearing the free space made no difference. I can't identify where the live data is because Recuva is listing it as being in the directory C: \ ? but there is no such directory. It's an NTFS disk. It says 'no overwritten clusters detected" Link to comment Share on other sites More sharing options...
Moderators Augeas Posted November 11, 2018 Moderators Share Posted November 11, 2018 Did you wipe free space using Drive Wiper? Drive Wiper overwrites the deleted records in the MFT so Recuva should return a long list of null, or ZZZ.ZZZ file names. All these null files should be a few hundred bytes in size, and be contained in the MFT. There shold be no clusters allocated to them. Are you still seeing the thumbnails? If you are, these should be found with a deep scan, and will have a numerical file name assigned instead of the actual filer name. These will not be overwritten by a live file, and can be securely deleted (which is just another overwrite). If you are seeing the thumbnails, go to the Info panel as described above and post a screenshot of what is there. Link to comment Share on other sites More sharing options...
kandyman2017 Posted November 11, 2018 Author Share Posted November 11, 2018 Ok I will try the process again. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now