Can I recover my .iso file?

[Sjakko]

Hi there. I accidentally started deleting four disk images with Eraser 5.7, each about 4GB. As soon as I realized I didn't want to delete one of them, I hit cancel. This was after a few seconds so Eraser probably didn't even start overwriting (or maybe just a part of the first .iso file). I noticed that two of the four files had disappeared from Windows Explorer, but it's just impossible that Eraser will overwrite more than 4GB in a few seconds, so at least one of the disappeared files should still be there on my disk. Is there any way I can recover it (and maybe also the not-overwritten part of the partially overwritten file?). I'd prefer a free tool. I used Simple File Shredder's tool to try recovering it, but i can't find a trace of the two .iso's. Thank you.

 

[Joel]

Nope. I'm afraid not. I don't know how much data is erased, but what I do know is that whatever's erased can't be recovered. Only a little bit may be erased but that may be enough to prevent any form of recovery.

If what you've tried doen't work then probably nothing else will.

Joel

 

[Sjakko]

OK thank you Joel. Too bad then. Well, let's look at this positive: it means that Eraser is doing a good job. :roll:

 

[Joel]

I mean you could try more advanced tools, but since you mentioned that you already tried using one tool I doubt other free tools can dot he trick. If the ISOs are really important I'm sure you could get a forensics team to help you...

Joel

 

[Overwriter]

it means that Eraser is doing a good job

Yes it certainly does. Once you “Erase” something you can be pretty sure it’s gone.

To avoid this situation arising again for you how about when you wish to delete some files etc make a new folder and place everything you wish to erase in that folder. You can then leave that folder for a while until you are absolutely certain that you intend to destroy those files for good. Then and only then erase them.

It’s rather like making your own version of a recycle bin. You could call it your Eraser Bin !!

 

[Sjakko]

To avoid this situation arising again for you how about when you wish to delete some files etc make a new folder and place everything you wish to erase in that folder.

Yeah that's possible, but when you cut a file and paste it in another folder, isn't that the same as copying the file to the folder and deleting the original file? That way, the original file can still be recovered. Or doesn't it work that way?

 

[Joel]

Moving to a folder IIRC does not cause a copy (the MFT is just updated). But if you want to be paranoid-ly sure then just erase when you mean to erase it and delete it when you don't!

Joel

 

[Overwriter]

To avoid this situation arising again for you how about when you wish to delete some files etc make a new folder and place everything you wish to erase in that folder.

Yeah that's possible, but when you cut a file and paste it in another folder, isn't that the same as copying the file to the folder and deleting the original file? That way, the original file can still be recovered. Or doesn't it work that way?

I don’t believe it works that way as explained by Joel in the post above. You can test this theory by cutting a very large file and pasting it in another folder and see how long it takes to paste there. It isn’t a very scientific test but you will notice that a massive file takes seconds to move in this way. Thus supporting the theory that it is just the MFT that is being updated.

The only time you will have trouble with this is if you are moving from one physical drive to another, such as from a flash drive to a hard drive etc. So my original solution should also state that it only works on the same physical drive.

If you are very worried about the deleted data on your drive you can always set the scheduler to wipe the free space once a week or more depending on your threat model. If you are really worried I suggest using Whole Disk Encryption but that is a whole new topic !