Drive wiper

[traveller44]

I have installed the free version of cc cleaner to try out the drive wiper.

I have run this on the drive, then run disk drill only to find out all files are still recoverable.

So i ran drive wiper again (3 passes both times) run disk drill, once again all files are still there.
Am i doing something wrong?

The files are definitely still recoverable as I recoverd a few as a test and it is the complete files....

[Bastet]

I would expect any disk wiper software for a complete/unrecoverable wipe wouldn’t work while Windows is running but perhaps that only refers to a complete disk wipe.
Have you restarted the PC after cleaning/wiping to delete the files completely?
 

[nukecad]

Can you tell us the exact drive wiper settings that you are using?
A screenshot is usually best.

What filetypes are being recovered?
Have you actually tried opening one or more of them?

[traveller44]

I am just trying to wipe the free space, so not the entire disk.
Settings as per picture. I have rebooted since using drive wiper.
Seems to be all types of file are still recoverable, Pictures, videos, audio, documents.
I am going to run once more.

 

 

Edited September 7, 2023 by traveller44
update

[nukecad]

Can you actually open the recovered files and see/read them?

It may be that all that is being recovered is the File Table record of where the file(s) used to be, but all that is recovered from the location is garbage. (Ones and zeros, or X's).

If it is just the File Table record (and garbage) being recovered then you should be able to wipe that too.

1. In Options>Settings there is also a Wipe Free Space option.
2. Tick it for the drive you want to wipe the free space on,
3. Additionally tick 'Wipe MFT Free space' underneath it.
4. Go back to Custom Clean; select the Windows tab and in  'Advanced' tick 'Wipe Free Space'.
5. Run Custom Clean.
6. Once it's finished then on the Windows tab > Advanced untick 'Wipe free space' again. (and/or untick the options in Settings)
   If you don't do that then it will do a free space wipe every time that you run Custon Clean, which takes time.
   You should get a warning about that when you tick it.

Try your recovery again.

PS. Just to ask- Is that 'New Volume (E:)' a seperate drive, or is it a partition on your SSD?
There is no need to secure delete or wipe the free space on a SSD.

[traveller44]

Deleting mainly for security purposes.

I have just tried to recover some jpg files and successfully recoverd 121 files from a folder.
So it doesnt look like it is just the file record that is being found.

[nukecad]

Mmm, you could try the other way through Custom Clean to see if that works for you.

PS. I have noticed some staff members taking a look at this thread, so they are aware that there may be an issue..

[traveller44]

i will try the custom method mentioned above and see if that makes any difference

[traveller44]

Ran in custome mode, can still recover many, many thousands of files.

Maybe to do with being the free version?

 

Maybe i should try the cipher command in Windows, nothing to lose I guess.
Just liked the idea of having an interface to work from.

[nukecad]

I've started doing some testing of Drive Wiper of my own here.
Something that I've been meaning to do for a while, but of course with multiple drive wipes and recoveries a thorough testing is going to take time, probably a few days for what testing I have planned so far.

My initial test results shows that wiping the Entire Drive with one pass using CCleaner's Drive Wiper does just that and nothing is recoverable using Recuva deep scan, I still want to check what Disk Drill says.

Then I'll test the Free Space wipe, and then probably the Custom Clean WFS too.
(And maybe Recuva's Secure Overwrite function if it does find anything).

To get/test as close to your situation as possible can you tell me the following:

• You didn't answer before if 'New Volume (E:)' is a physically seperate drive, or a partition on your SSD?
• If physicall seperate then what type of drive are you wiping/recovering? (HDD?, SSD?, USB stick?, SD card?, NAS drive? other?)
• What filesystem is it formatted as? (NTFS?, FAT32?, ExFAT?, other?)
• Approximately what size in MB or GB are the files that you say you can recover?

I note that you also have not replied to my question of whether your 'recovered' files can actually be opened and viewed.

[traveller44]

I believe Drive E is a seperate drive of 2TB.

Trying to wipe the free space on Drive E HDD.

File system is NTFS.

Recoverable 1.45TB.

I have recovered photos using disk drill, but I think this is misleading with regard to the results.
Meaning although listed as recoverable some that I checked are not deleted files.

If I use Recuva, there are just three files recoverable, none of which I understand
I think I will delete a couple of files , run Recuva again and see if those files are listed.
If so its the disk drill report that is misleading.

 

 

[nukecad]

Ouch, wiping space, and running recovery scans, on a 2TB drive is going to take time.

The 3 files found by Recuva will be the System Volume Information files. They in a normally hidden folder

 Disk Drill hasn't found anything here yet.
It's currently running on a drive where I deleted some files then used CCleaner to wipe the free space.
Recuva couldn't find anything to be recovered.
I'll see what DD says.

I do have to note again though that you are still talking about " listed as recoverable".

You have not answered my (repeated) question about if you can actually open/read those files if recovered.
As you aren't answering that question then I can only assume that you haven't actually tried?

[nukecad]

Going back to the hidden System Volume Information folder, there should also be a Recycle Bin that is normally hidden on the drive.

If you don't know about that recycle bin then it's likely that you haven't emptied it.
And if you hadn't emptied that bin, then Wiping the Free Space would not get rid of the files in it.
So they would still be recoverable.

See the first reply here:
https://answers.microsoft.com/en-us/windows/forum/all/managing-a-recycle-bin-on-an-external-drive/2a8cc469-50d0-4354-8990-0029fbc00462

PS. Obviously Wiping the entire drive would get rid of them.

[nukecad]

The second round of my testing has finished:

Copy 16 mixed type files (jpg, docx, xls, pdf, etc) to a (empty) drive multiple times into folders, delete one set of the 16 files, clear the recycle bin on the drive.
Use CCleaner Drive wiper to wipe the free space on the drive, 1 pass.

Check with Recuva deep scan.

• No files were found to be recovered.

Check with Disk Drill.

• DD shows existing (non-deleted) files as well as 'Deleted or lost' files.
• It showed 1177 'Deleted or lost' files totalling 444 MB - Which seems odd since I only deleted 16 files totalling 12 MB.
• The 'Deleted or lost' files found all had filenames made up of multiple Z's - that is how they should be following a Free Space Wipe.
• Drill Disk predicted a High chance of recovery for them, so I recovered some of them, 20 to start with:
• Recovery took literally less than a second because what was actually recovered was a bunch of 1KB files all with names made of Z's, nothing in them they are names only.
  (I'm guessing that there is a ZZZZ file for each cluster that the 16 deleted/wiped files used to occupy? eg. 1177 zeroed clusters each given a ZZZ filename and then deleted).

So the files had indeed been zeroed, and all that is left of them is traces of a deleted bunch of 'ZZZ....' filenames.

Recuva knew that at 1 KB in size those files could not be any more than a name only and were not worth recovering, so it didn't even offer them for recovery.
Disk Drill either didn't know that, or knew it but offered them anyway.
(If I was being cynical I would note that the 16 deleted files (12 MB) became 444 MB of files to recover, which is very close to the 500 MB limit that Disk Drill will recover for free).

In conclusion I'd say that the files are wiped, with no chance of their previous contents being recovered, but Disk Drill is offering to recover the useless ZZZZ.... filenames anyway.

I don't think that I need go any further with testing.

 

[nukecad]

So where does that leave @traveller44 and those reported Disk Drill scan results?

I suspect that what Drill Disk is finding in that case are previously deleted files that are still in the drives Recycle Bin.
The reason that I suspect that is because from what has been said they seem to still have filenames and not just Z's.

The space that they occupy is not 'Free Space' - because they are still in the bin taking up space.
That being the case then they will be recoverable, just like the files in any Recycle Bin can be restored.

To get rid of them completely that bin would need to be emptied so that it became 'Free Space' to be wiped.
Alternatively wiping the the entire drive would remove them completely.

[traveller44]

Bit of an update.

So ran recuva, pic1.

Then drive wiper, pic2

Drive wipe complete, pic 3

Ran recuva, pic4
However stupidly forgot to try and revover some of these files to see if they were complete, so may have to run again