Jump to content

Wipe Free Space by Ccleaner


Recommended Posts

Today morning,  I used a 3 pass option for 'Wipe Free Space' through C Cleaner software against an extra SATA disk (F:\). Once it was completed, I checked it with my EnCase  forensics software, I created a snapshot of the ambient slack prior to the wipe and another following the wipe. The difference revealed that only 1/3 of the actual deleted data was un-reconstructable i.e.  tough the all the deleted file names were visible but only 1/3rd could not be restored while the remaining 2/3rd of 'wiped' deleted files were fully recoverable and viewable within the EnCase gallery. I wonder if its worth paying for a software which doesn't complete the job entrusted it to do?

Any views on your experiences on this and if any other software is available that could finish the job well?

Link to comment
Share on other sites

  • Moderators

In future runs forget three passes, one will do. Shooting a horse three times doesn't make it three times deader.

Did you use WFS from Options/Settings or Drive Wiper?

Slack space does not contain deleted file data, it contains what was there in the unused space if the file didn't completely fill the last allocated cluster. A deleted file cannot be reconstructed from slack space, by definition.

CC WSF does not care about slack space anyway, or even files, as it operates at cluster level. There are some circumstances where WFS will leave some clusters untouched, and some small deleted files will remain unwiped, but I don't know if this applies in your case.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.