DiskDigger retrieves deleted photos

Can someone please advise on this. i wiped all my deletedffree sapce aerlier then ran disk digger and it brough back all of the jpegs etc. Confused the hell outa me.
 
It can very easily happen. Remember that Eraser can only erase the space that is marked as free. So if the system has created security copies of files elsewhere on your system in space not marked as free, those copies will not be erased. In my experience, the people who design file systems tend to regard file safety as being almost the same thing as file security, and to the extent that it isn't, the think that security issues can be fully dealt with by controlling access to files. Both of those create problems for people who wish to remove data permanently from their systems.

The main culprit is usually System Restore, in particular its shadow file copying feature, which most users are unaware of and yet which is enabled by default. Users who are concerned about the privacy of their data should, in my view:
  • turn off System Restore on all but the system (C:) drive;
  • turn of the shadow copying option even on the C: drive;
  • regularly delete system restore points that are not needed.
Eraser works best as part of a suite of security tools. In particular, I use it in conjunction with CCleaner, which not only automates the process of removing system clutter, but which also has a number of useful additional tools, one of which is a simple tool to remove unwanted restore points. With that done, run the free space erase again (with the default or other single pass erasing method, to keep the process time as short as possible), and see how many files you can still recover. If there are still problems, we made need to look a bit deeper into your system.

David
 
Hey thanks for this, i think I get it now. It has randomised some of my stuff with various outside sources. Knda interesting
 
Whatever 'it' is (and 'it' is not Eraser), randomising is almost certainly what it has not done, so I'm not sure that I have explained this effectively. But without a better understanding of what you mean, there's not a lot I can add.

David
 
Well disk digger said it had retrieved 31,000 jpg's and I have nevr had anything like that many on the machine,

I also get this red message a lot

Session: Monday, June 18, 2012 3:45:21 PM
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d0af1c823ba7f5d11a2831168f7e6d00_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d0e0403960ddbbd4dc3d127154963213_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d14bf2407a73e1d54d8bf738397d8d6c_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d1926a0af93acfd2dac16d752839a0c3_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d1a7d99c15479e38abb1d86b50ff2217_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d1d2aa31c3d9bcf4bf42221dc5014f70_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d1e8ad500a051eb48350df05e85c80d9_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d2916a854f9e229a176d82c74cae168b_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d2940067753db84d4e1d6b536e0cc220_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d29a476fb9d29406e64207ef1bd48dc2_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d30ce7d570d640d11e6af08b20546a29_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d339a028781914182abdff9dfe97dfb0_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d362d736eb63b0232729ed424dc3d941_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Monday, June 18, 2012 3:47:37 PM Error C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d36e30877f12b4dd7a6811de915b126a_edee2946-49fd-4ce0-9860-a540def37551 did not have its cluster tips erased because of the following error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

I also get "cluster tips have not been erased because you do not have the necessary permissions"

Like my log file seesm to be huge and never ending. i also get "cluster tips not erased because such and such is a sytem file"

Thanks for taking the time - much appreciated. I also use cc cleaner, but i don't know what is going on here :-).
 
Cluster tip 'errors' of the kind you quote are inevitable, particularly on a C: drive. I have suggested to JOel that these should not be regarded as errors at all; this is part of a wider discussion about the way event logging works in Eraser. These non-errors have nothing at all to do with your particular issue, which is likely to have the cause I have described.

To change the settings for System Restore, go to ControlPanel->System->System Protection, configure the settings for each drive, and use the button to delete previous Restore Points. I see that Volume Shadow copy cannot be turned off separately from this dialog; this irritating behaviour is because Microsoft techies labour under the delusion that shadow copying is actually useful (which, for most people, it isn't; you need proper backups). You can, however, use the Task Manager to disable the shadow copying service.

David
 
Since it is recovering 10s of thousands of JPEGs, I believe your photo-recovery software is likely doing one or both of these things in addition to recovering stuff from "free" space.

1. It is finding ALL JPEG files on the system, not just the deleted ones.

2. It is finding JPEG files embeded in files that don't have the JPEG or JPG extension by looking for unique JPEG format identifier bytes (the four letter code JFIF) throughout all the data on the harddrive, as that pattern always is present in the header of a JPEG file. Upon finding this data it reads the full header and retrieves the image. JPEG files can be embeded in other files (such as a program's EXE file) and used as image resources for certain programs (you know like how programs have things like splash screens, images on their buttons, and other such embedded image data that is NOT in separate image files).
 
Yup, JoeDoe got it there.
 
You must log in or register to reply here.
Back
Top