Recoverable deleted and overwritten files w/ CCleaner

[Kevin Bordeleau]

I have deleted and used secure file deletion and very complex overwrite with CCleaner Professional several times and also erased free space, for erasing JPEG files, and after downloading RECUVA, I can still recover these erased JPEGs. Why are these erased files still obtainable on my PC? I can't seem to erase them permanently. Wipe Alternate Data Streams & wipe cluster tips was not checked in my erase options. Is this the problem? Thank you.

Edited March 22, 2023 by Kevin Bordeleau
added info

[Kevin Bordeleau]

I have deleted and used secure file deletion and very complex overwrite with CCleaner Professional several times and also erased free space, for erasing JPEG files, and after downloading RECUVA, I can still recover these erased JPEGs. Why are these erased files still obtainable on my PC? I can't seem to erase them permanently. Wipe Alternate Data Streams & wipe cluster tips was not checked in my erase options. Is this the problem? Thank you.

I posted this in the wrong category before. Sorry for that.

[Kevin Bordeleau]

I reposted in other correct category CCleaner

[Nergal]

Moved and merged

[nukecad]

Is Recuva actually recovering viewable JPEG's, or just recovering a filename with blank data in the actual file?

[Kevin Bordeleau]

recovering viewable JPEG's

[Andavari]

When it's doing that the only other alternative is to use Wipe Free Space, although it isn't really all that feasible on modern 1TB and larger HDDs since it will literally seem to take forever if the disk isn't already very full.

[Kevin Bordeleau]

Yes I have done that also. Still no luck. My PC is 2TB and 11 years old. I wiped free space again tonight and the files are still not erased. At least 100 that I want erased permanently. Thanks for the replies.

[Augeas]

I have never known overwritten files (that's what secure deletion and wipe free space does) to be recoverable - if the overwriting has actually taken place. If files are still being seen, and recovered, then they must be:

1) Small (under say 700 bytes) and held in the MFT and WFS hasn't wiped the MFT

2) Are actually live files which are now occupying the space the deleted files were

3) Were never actually overwritten in the first place

I ran some tests a few years ago and found that WFS can miss some files. It appears that on a heavily fragmented disk, with many smallish unallocated spaces between files, the file allocation that WFS does is too large to catch these spaces (WFS allocates zero-byte files and then deletes them, thus overwriting free space).

There may be other reasons that I can't think of.

What does the Info pane of Recuva say about these deleted files? Just one or two would do.

Can you overwrite these files in Recuva? Just one or two would do.

[nukecad]

Were you using 'Wipe Free Space' in Custom Clean?
You have to tick that both in the settings and also in the list under Advanced. If you don't tick it in both places then it doesn't wipe the free space.
You should know if that happens because it won't take any time.

The above is setting it to wipe the free space and MFT on drive D: - IF/WHEN you also tick 'Wipe Free Space' under 'Advanced' in Custom clean.
In this screenshot that hasn't been ticked, so the free space won't get wiped.

 

It's not something I do often but I recently had cause to wipe the free space on a couple of external drives - I used the Drive Wiper in Tools:

Set at 1-pass was enough so that Recuva then couldn't find anything to recover from them.

Note that one of the drives I wiped the free space on was a 1TB drive with just under 700GB free space, it was plugged into a USB2 port and took 10+ hours to do the 1-pass wipe. (It would have been quicker in a USB3 port but it would still be hours).

[Kevin Bordeleau]

I am using the Drive Wiper option. I did not have the box checked in the ADVANCED menu. I only had it checked in this place. see pic. Thank you for the instruction. Will be cleaning it again. Thanks again!

Edited March 23, 2023 by Kevin Bordeleau

[Augeas]

That screenshot shows the settings in Custom Clean. If you are actually running Drive Wiper the settings shown above will not apply.

[Kevin Bordeleau]

nukecad, I followed your instructions and have completely deleted and erased all the picture files left behind on my PC. I used the option of 1 single overwrite pass on the Drive Wiper. I will remember now to tick BOTH places on those pages on my CCleaner. Thanks for taking the time to explain and post photos for me to understand better. And thanks to all those who replied. CASE CLOSED!

[nukecad]

Good to hear you got there.

'Wipe Free Space' is part of Custom Clean and it's a 2 part thing.

• Part one is What-to-wipe and is in the settings where you set up which drive(s) you want to wipe the free space on.
• Part two is When-to-wipe and is in the Custom Clean lists.

So you can set which drives to be wiped, but don't actually wipe them everytime that you run Custom Clean. (Because a free space wipe takes a long time).
When you do want to wipe you tick the box in 'Advanced' and then run Custom Clean.

'Drive Wiper' is a seperate, different, tool. with it you can choose to wipe a drive completely, securely deleting all the data on it and not just the free space.
Use that option carefully, if you set it to wipe 'Entire Drive' then it will delete and wipe any/all files on the specified drive and they will then be unrecoverable.

It won't let you completely wipe your OS drive (usually C:) because that would wipe Windows and brick the machine, so it only lets you wipe free space on the OS drive.
Drive Wiper is a one screen tool, you set it there and click on 'Wipe' to run it.

[Kevin Bordeleau]