Files can be recovered after Wipe Free Space

[mfa]

Hi everyone,

Honestly, I am a bit puzzled.

I have a HDD of which I am trying to erase unused space. I have used Ccleaner for this with both 1 pass and 3 passes. However, when I use Disk Drill to check the there are any recoverable files, it finds ALOT of files. As an example it finds 12.000 jpg pictures. And yes, it is not just small temporary files, but actual pictures that i can preview and recover! This is disturbing to me....

It should be mentioned that I have also tried to use Eraser and BCWipe to clear the unused space, but still Disk Drill finds the files. If i use Recuva to recover files, it finds 0 files. Therefore im in doubt what is going on. Is Disk Drill showing files that are not deleted? Do the different tools not have common understanding of what deleted files are?

Im runnning a PC with windows 10 Home and Ccleaner 5.72.7994. The HDD is a 500 GB NTFS drive.

I also have SSD drives where i want to do the same, but lets start with the HDD.

Any ideas why I can still recover these files??

[nukecad]

It's what is called an arms race.

"We use advanced tools to wipe your drive".

"We can get round that".

The national security services usually have the best recovery tools.

From reselling work computers if you take the hard drive out and whack it with a lump hammer that (usually) makes it unrecoverable.

[Andavari]

12 hours ago, nukecad said:

From reselling work computers if you take the hard drive out and whack it with a lump hammer that (usually) makes it unrecoverable.

That's why if anything like finances, tax documents, etc., that someone doesn't want anyone else to recover off a sold PC it's best to just replace the drive with a brand new unit, for example a 120-128GB budget SATA SSD for the OS drive (they go for $20 USD or less at the moment from good brand names like ADATA, Kingston, SP Silicon Power, TeamGroup, etc.,) for the OS and the PC will seem fast which can help sale it easier. A cheap 120-128GB budget SSD is at least half the price of a brand new 1TB HDD so let whoever buys the PC replace that drive with a capacity they want.

[Augeas]

It's difficult to give an answer without more details so we can only generalise. Did you use CC's Drive Wiper or WFS from Options/Settings?

First of all Wipe Free Space is an overwrite operation, it does not explicitly remove anything. A WFS works by filling a volume's unallocated space with files holding zeroes and then deleting them, thus overwriting the data in free space.

NTFS volumes have a Master File Table which holds a record for every file on the volume. These records are flagged when a file is deleted, and subsequently can be reused, but they are never removed from the MFT. A WFS may - depending on the settings - overwrite the file names in the MFT's records. After a WFS Recuva will still list all these deleted records, with file names which may be valid or not, and these files can be recovered (in as much as the file's overwritten data can be retrieved). But they will either be all zeroes or small zero files. In other words no use to anyone.

I have no experience with Eraser, BCWipe or Disk Drill so I don't know what they are showing. I would say though that CC WFS does overwrite the vast majority of free space, and when that is done, with one pass, that data is not recoverable by any means known or available to the hoi polloi.

Don't run WFS on SSD's. If they are reasonably modern with TRIM enabled then all unallocated clusters will return zeroes.

[mfa]

Hi Augeas

 

I simply used Ccleaner (free) and went to tools->Drive Wiper ->Free space only with both 1 and 3 passes. However, I see that I did not check the "Wipe MFT Free Space" option under settings. Is this necessary? How about the "secure erase" option?

 

Do I need to run Ccleaner as admin ?

It sounds like you are confident that the files should not be recoverable, but it seems to me that Disk Drill is doing a pretty good job recovering them.... Im suspecting some setting or something is making it impossible for me to clean up....

[Augeas]

Drive Wiper runs a wipe MFT before a WFS, in as much as it overwrites the file names and data in the MFT. The total number of deleted files in the MFT remains the same, but the file names and data have gone. WFS in Options has no affect on Drive Wiper settings, and Secure Erase has no effect on WFS at all. So stick to Drive Wiper.

I don't know what Disk Drill is returning (and I don't really want to know). I know that once CC Drive Wiper has overwritten the free space (and it does a preety good job at that) then that overwritten data can't be recovered by any means. Maybe DD is returning deleted file names (which should be ZZ.ZZ after running Drive Wiper) or maybe it is returning live files, but it cannot, under any circumstances, return any data that was there before being overwritten.