Deleted files still found

J

jaffacake2000

New Member
I just used the eraser program and did the DoD 7 passes to erase the data to make it unrecoverable but when I use file recovery programs it still finds all the data and i even recovered many of the data and programs myself which are still also full functional.

So, does the program really work?
 
It sounds like you erased something and recovered something else. Don't worry, this is quite common. Eraser only overwrites the files you tell it to erase, nothing more. Anyway, browsing through some of the older posts in this forum should answer your question.
 
Complete erasing.

I suspect that some sort of error in the use of the application has occurred in view of the millions of satisfied users! However,and I may be guilty of the same offence,I do notice that very occasionally I have to run the application more than once to achieve complete erasing-usually when there are many files or folders to erase "on demand",as I clear the junk away from my three browsers! If you are positive all is set up correctly,maybe try running it twice?
 
if boot-up from a dos disk and do it from the dos level will it delete the empty space only? because i dont want it to completey wipe off everything on my hard drive (i.e. OS and data) just the empty space only.
 
But why are you not doing it through Windows(if that is your OS)? I.E.-rt. click on "C" in My Computer page and then click "wipe unused space" - or am I missing something here?
 
I read somwhere on that website if you boot up from a dos disk and clean it before windows loads-up, theres 99.9% guarantee it will be securely wiped/erased.

Maybe ive been cleaning it from within windows all this time and thats why other data recovery programs still find all the deleted files?
 
You mean if you defrag your disk then erase unused disk space? That would work. Altough we have recovered redable data from files erased using Eraser 5.7 in recent tests.
 
we have recovered redable data from files erased using Eraser 5.7 in recent tests
Click to expand...
Yes, I too have recovered readable data from files erased using Eraser. It turns out it was the pattern the program used for overwriting. I think this clearly proves that Eraser doesn't work, I mean, I shouldn't be able to recover any data, right? What a scam.

Worse yet, I then converted the recovered data to a WAV file and played it in reverse, only to discover that it contained some kind of evil demonic message. I don't care how do you live your life, but how dare you plant this stuff on my hard drive!? I'm appalled, shame on you!
 
The only program that we used first was File Scavenger, pretty basic but still recovered data we had deleted. I thought it maybe my hard drive but it wasn't, my friend installed Eraser 5.7 on his PC and we got the same results. My hard disk is a Western Digital & and his was Seagate. At the end of the day, people who use programs are really lowering them selfs into a false sence of security. I doubt they would be recoverble to the avg Joe but someone who is a little more techincal minded with some spare time to burn could find deleted data.
 
First of all, when you erase a file from your hard drive, it may still be possible to recover the exact same data from your hard drive. Eraser does not search your drive for each instance of the data you erased, it only erases the specific sectors you tell it to erase. In other words, only that specific copy of the data. I can guarantee that if the erasing was successfully completed, you will not be able to recover old data from these overwritten sectors.

People who post messages on this forum claiming to have recovered overwritten data with program XYZ did not actually recover the data they just erased, they recovered copies of this data stored elsewhere on their hard drive (backups, system restore files, browser cache, NTFS journal file, swap file, temporary files etc.). It appears to be quite common that they don't even understand what exactly they found. The next step is to post here complaining that Eraser doesn't work.

To sum it up, it is absolute nonsense that anyone here could have recovered previous data from overwritten sectors, so I would appreciate it if we could we please drop this topic once again.
 
The test disk was first wiped with 32 rounds using CSPRNG. The hard disk was a 20 gig Western Digital hard disk running Windows XP on a FAT32 FS.

First of all we defraged the test disk & made sure there were no errors on the drive. Wiped slak/unused free space and also wiped/turned off swap file.

Made one new directory on C:\ named "Test" with 12 files inside which were BMPs, Gifs and Text files. Erased 6 files using Dr. Gutmann's method and 6 files using the 7 pass DoD method. All temp directory's were erased.

On this second test the recovery tools used were Ontrack's EasyRecovery Professional & Stellar Phoenix FAT. An image was built of the hard disk and while running EasyRecovery Professional for 25 minutes, 9 files were found and were readable but were a little damaged.
 
After reading this post i did a small test myself. I cleaned the free disk space on a back-up drive (without the OS on it), including cluster tip area and directory entries. To make sure no program could "get in the way" I used this program http://www.geocities.com/coolvicki7/SD.html to start Eraser. The result was not as expected.
It was very disappointing to find that even a simple program like Restoration 2.5.14 was able to see names of files that were deleted ages ago. I didn't even bother to check whether those files could be recovered. They should not have been visible at all in the first place.

After that I downloaded and installed BCWipe. This did a perfect job, even while many programs were running. Nothing but scrambled names were visible after it had finished.
Conclusion: Eraser doesn't live up to its reputation.
 
There are two common questions asked about eraser.

1. I erased file 'x' and could recover it.
2. I erased the freespace and i can still see the file names.

Answer: 1

If you erase a file the clusters used by that files are erased.
A disk recovery program will try to recover those clusters but will find garbage. You can test this by creating a file with notepad and filling it with 'aaaaa' then erase it and see what you can recover.

If you are using any kind of unerase app or products like MsWord. No Eraser type application will guarantee the data is wiped. Eraser will wipe the current file 100% but as MsWord and unerase type programs keep copies of any deleted file or in the case of MsWord a backup while you are editing. Erasing the current document will only erase that. But the backups are still scattered all over the drive.

Equally if you defragment a drive you may find traces of an erased file because the original file is potentially moved all over the disk. The current copy is erased but a forensic scan of the drive may locate parts of the file where it was being moved around during the defragmentation.

Answer 2:
If you erase a whole drive eraser will not clean the MFT/FAT. To do that you need to format the drive after which is what BCwipe I think does. Formatting is the only way to safely remove the ghost entries from the MFT/FAT. So after erasing a drive you need to finally format it. Equally you will be able to recover 'data' from these files but only the erased information and not the original data.

In addition to never defragmenting your drive before erasing you should run chkdsk/scandisk to recover any lost clusters and erase those first.

If you try to erase files in use it will fail. Attempts to erase working programs/files in use will fail as the eraser program cannot lock the file to erase it.

Finally:
If you want to guarantee the erasing of a file the only way is to nuke the whole machine. This is because potentially data may have leaked into the pagefile, the registery, documents and databases. For example if you delete some document 'supersecret.doc' and a few mins later your database expands its files the clusters used by the document are used but the database now contains the document. While the database knows those blocks are free a text search of the database will reveal all.


Garrett
 
Ok, that's clear. Thanks for the reply. However, there is some problem with removing filenames while deleting files (not the "ghost entries"). I found that when erasing multiple files\folders some filenames are left untouched, i.e. visible with an undelete program.
 
Actually, the deleted data isn’t really “deleted” after your losing, but still exists in the device, it just becomes hidden and invisible ,so this is the reason why we could recover it with the help of data recovery toolkit. what happened to you mentioned above is normal. Maybe you don't need such suggestions now, however, once you has delete your data accidentally and you want to retrieve deleted data from iPhone next time, try to use iPhone data recovery to assist you. it will work for you. Good luck to you.
 
You must log in or register to reply here.
Back
Top