Filenames and other data showing but data unrecoverable

[Grumpyoldgit]

Hi All

I've been using Recuva for a while now but this is my first time on the forum; today I used it to check a drive on which the files had been 'shredded'. Now, I know that shredding isn't a failsafe method of erasing but what puzzled me a bit was that there were files that showed as Unrecoverable and the comment said "File's data could not be found on the disk." but Recuva was still able to find the filename, path last modified date and file size.

So, my question is, if the file's data can't be found, how is it that all that other information can be? I should point out that I'm not looking to recover the files.

Thanks in advance

[nukecad]

It's because that file information still resides in the Master File Table (MFT) of Windows, marked as a deleted file.

(So recovery programmes can see where the file data was and see which clusters to try and recover).

However if you have shredded or securely deleted the file then the disc clusters that it points to have been overwritten with random data, typically zeros and/or X's,  so that there is no data left there to be recovered only random digits.

I believe that 'Wipe MFT Free Space' from Custom Clean can remove the deleted entries from the MFT if that option is selected in Settings, - but to do that you also have to wipe all the free space on the disc which can take a while if it's a large disc. ('Wipe Free Space' is an option that you should not normally have selected).
Note that is 'Wipe Free Space' in Custom Clean - 'Drive Wiper' in the tools will not wipe the MFT free space.

[Grumpyoldgit]

Thanks nukecad, for some reason I didn't think of the MFT. I'll have to take a closer look at the cleaning tools in ccleaner.

Cheers

[Augeas]

To clarify a little, as I understand it Nukecad, WFS in Drive Wiper runs a wipe MFT before the disk wipe. Unless things are different in Custom Clean, but I never run any WFS to test it.

[nukecad]

10 hours ago, Augeas said:

To clarify a little, as I understand it Nukecad, WFS in Drive Wiper runs a wipe MFT before the disk wipe. Unless things are different in Custom Clean, but I never run any WFS to test it.

There is no (selectable) wipe MFT free space option in the Drive Wiper tool, the options are 'Free Space Only' or 'Entire Drive'.

The only  wipe MFT free space setting is for a Custom Clean WFS, and I don't believe that the Drive Wiper tool reads that setting.
There are a couple of other options in Custom Clean WFS that are not in the Drive Wiper tool. ('Wipe alternate data streams' and 'Wipe Cluster tips').

I personally think that is why the WFS option/settings is/are still there in Custom Clean at all, to give more control over wiping free space.
There would be no need for it still to be there if the Drive Wiper tool had exactly the same settings available.

Unfortunately the documentation is pretty poor and unclear on just what these different settings actually do.

It is noticable that none of the other tools are 'duplicated' in Custom Clean. Why wiping free space should be, and have different options, would be a question for the developers.
Possibly it's similar to the difference between Custom Clean and Health Check - If you want more control over what is done then you have to use Custom Clean.

[Augeas]

It's true that in Drive Wiper there is no option for selecting a wipe MFT, but that's because you get it anyway as a freebie. If Drive Wiper WFS is run you will see a Wiping MFT message at the start of the run. It could be argued that a WMFT is part of WFS, as some file data is held in the MFT record and is not wiped by a 'normal' WFS.

As far as I know the WFS parameters in Options/Settings have no effect on Drive Wiper.

The Wipe Alternate Data Streams and Wipe Cluster Tips are settings for Secure File Deletion, which is not part of Wipe Free Space.

I think that the reason why WFS is still available in CClean is that it could be incorporated in the users CClean runs, whilst Drive Wiper is a stand-alone operation. I suppose there are some users who would want that, although it seems rather excessive.

I have to say that I've never run a Wipe MFT in my life, and only run WFS when I was getting rid of my old kit.

[nukecad]

5 hours ago, Augeas said:

If Drive Wiper WFS is run you will see a Wiping MFT message at the start of the run.

Thanks for that info.

So Drive Wiper does it anyway and you have no control over that. (A bit like the way you have no real control over what Health Check does).

I have not really had occasion to use either method.