Cant delete C:\ cluster tips?

[jop]

i have win 7 ultimate x64. i've tried to recover lost files after using eraser and i was able to recover tons of personal files.
this is the error that concern me:
Session: Wednesday, May 26, 2010 4:19:54 PM
Wednesday, May 26, 2010 4:19:54 PM Error C:\ did not have its cluster tips erased because of the following error: The process cannot access the file because it is being used by another process. (Exception from HRESULT: 0x80070020)

i have 6.06 version of eraser. please help!

 

[jop]

also ive beein wiping with USDoD 3 passes. Is it required to use more passes for everything to be wiped?

 

[DavidHB]

1. Your error message is normal. Files will be in use (particularly on a system drive) while Eraser is working, and therefore inaccessible for cluster tip erasure. It is rather unlikely that this is a significant security/privacy problem.

2. If you are referring to a free space wipe, the default is a single pass wipe with pseudo-random data; anything else takes a very long time, and current thinking is that even a single pass wipe of a modern hard drive is sufficient to put deleted data beyond practicable recovery. For erasing files and folders directly, it's probably worth using a few more passes, but 3 (which is what I too use) should be fine. The default (Gutmann) method is overkill; it was set as the default to put users' minds at rest, because the Gutmann methodology has been quite widely publicised, and people tend to feel (wrongly) that it is the only safe form of erasure. If only life were that simple ...

David

 

[jop]

hi, thanks for the help.

But ive run this program many times over night and it seems to do absolutely nothing as far as whiping old files. using recovery software i can recover pretty much everything. program simply doesnt work, maybe it has a problem with win7 ultimate.

i can see it working to create rubbish files in C and deleting them, so i dont know what the problem is.

 

[DavidHB]

By 'old files', I assume you mean files you have already deleted. Eraser, as you have seen, fills the free space with random data, then wipes the free entries in the MFT. But if the file system has reserved some space, for example for shadow copies or the contents of System Restore points, that space will not be wiped. The issue is not your OS version, but, assuming that it is NTFS, the way the file system works together with Windows to make (and then, often, protect), copies of data all over your drive. For better privacy, turn off shadow copies on all drives, and System Restore on any non-system drive. Also, use the Windows feature to wipe the paging file on shutdown once in a while.

The best way to erase files securely is to do it directly; then Eraser will be aware of shadow copies and deal with them. Free space wiping is an extra layer of security, but is not necessarily the complete answer, particularly on a system drive. You don't say which file recovery program you are using. I use, among others, Recuva, which has a useful feature to erase any files it finds (if it can; there are files it cannot erase). This usefully complements what Eraser can do.

I find that programs like Eraser do a much better job on non-system drives, and therefore try to segregate programs and data on to physically separate drives.

Without more details, this general response is the best I can do. If you are able to describe your particular issue step by step, I may be able to help further.

One final thing. The Eraser Window may say Version 6.0.6, but please check Help|About. It may say 6.0.7, which is the current 'stable' version. If it still says 6.0.6, upgrade to 6.0.7, which has a lot of bug fixes.

David

 

[jop]

appreciate the explanation. kind of interesting as well. And i think recova has worked well.

to clarify, a system that has been regularly deleting files for a while using windows will need to use eraser and recuva.. i.e. eraser simply cannot do the full job on ntfs system?

and lastly, how sophisticated is recuva at finding files to wipe? Obviously there were many things eraser and Ccleaner didnt destroy. Could a more sophisticated software find even more files? I was using "pc inspector file recovery" before to try to make sure the job was done.

 

[DavidHB]

to clarify, a system that has been regularly deleting files for a while using windows will need to use eraser and recuva.. i.e. eraser simply cannot do the full job on ntfs system?

With some issues that I hope will be fixed in the next release, Eraser does what it is supposed to do as well as (or in some cases better than) any other application that is freely available. But it can't be expected, for instance, to wipe free space if that space has not been marked as free. Nor can it be expected to access files if the the OS is 'protecting' them, even from users with administrative privileges. Security/privacy requires a 'layered' approach, using different tools and above all requiring users to be security conscious. That is true of any file system; NTFS just has a few more issues than, say, FAT32.

and lastly, how sophisticated is recuva at finding files to wipe? Obviously there were many things eraser and Ccleaner didnt destroy. Could a more sophisticated software find even more files? I was using "pc inspector file recovery" before to try to make sure the job was done.

I don't know how good Recuva is relative to other applications, as I haven't seen any comparative tests (which might be misleading in any case). The principles of recovery are well understood; I would expect Recuva in its single pass mode to be pretty similar to other programs. The deep scan mode may step things up a notch, though my experience is that, after a wipe, it typically doesn't find anything recoverable that the single pass has not already found.

More sophisticated software (when used by a very knowledgeable operator, of whom there are probably not that many), could probably reconstruct more 'deleted' data from file fragments that Eraser can't touch and Recuva can't find. But the effort involved is likely to be very considerable; a machine would probably need to be a special target of, say, a sophisticated national security service to justify that kind of effort. For ordinary users, the measures I listed in my previous post are sufficient to deter all the snoopers their machines will encounter.

David