erase unused space - not erase all old stuff?

[webwilli]

i erase my unused diskspace with this options:

so i erase unused space on my data partion. after the procedure i check the partition with Active@ File Recovery for Windows. And i must see that the File Recovery Tool find many many pics (jpg, bmp, gif...) and much more data.

how is it possible? the pics was normally deleted. without eraser.

 

[Carver]

I think Eraser will only erase the files after Eraser was installed. I had the same problem when I first installed Eraser. What I did was create a folder on my desktop and using the file recovery tool, restore the files to a alternate location...the folder on my desktop. Then I erased the content of the folder. I don't think you can restore the file into the recyle bin, so the folder will have to do.

 

[spy1]

Hi, Carver!

It seems to me that freespace is freespace - whether generated prior or subsequent to Eraser installation (I could be wrong, I'm no expert).

At any rate, I've checked after Eraser runs with RecoverMyFiles (similar to Active@File Recovery), and it, too said there was a good possibility of "recovering" numerous files.

The problem with that claim was that RMF was also showing me at the same time that the file names themselves were blank (all zeroes), as were the contents of the files themselves.

This is what the author of that program says about "shredded" files:
http://forums.getdata.com/showpost.php? ... ostcount=2

So, unless the OP has actually restored some of these files that are supposedly recoverable, I'd tend to believe that they actually aren't recoverable.

I'd really like to see a screenshot of the results of what, exactly, the program he's referring to is showing. Pete

 

[Robbie]

I think Eraser will only erase the files after Eraser was installed. I had the same problem when I first installed Eraser. What I did was create a folder on my desktop and using the file recovery tool, restore the files to a alternate location...the folder on my desktop. Then I erased the content of the folder. I don't think you can restore the file into the recyle bin, so the folder will have to do.

Eraser will delete whatever is in freespace - regardless of whether the file was there before Eraser was installed.

Eraser doesn't see "files" when deleting freespace. It just sees unallocated sectors and writes over them. Unless I'm wrong and the program really can tell that not only is there a file occupying part of freespace, but it can then read the date it was placed there too...

 

[Robbie]

Hi, Carver!

At any rate, I've checked after Eraser runs with RecoverMyFiles (similar to Active@File Recovery), and it, too said there was a good possibility of "recovering" numerous files.

The problem with that claim was that RMF was also showing me at the same time that the file names themselves were blank (all zeroes), as were the contents of the files themselves.

Eraser works by overwriting sectors which are marked as unallocated (ie freespace). To do this it creates thousands of temporary files which are then erased themselves at the end of the process. It creates smaller files rather than one or two larger files to speed up the process.

The end result is that after running a freespace wipe, the user will see thousands of files of 0KB in size, and each file will have a file name that is a string of 0's with a unique set of random numbers/letters at the end.

Like this

00000000000000000000000000000000000000000000000QS35P.

Any file recovery software will pick up that there are recoverable files, but those files will contain no data.

 

[Robbie]

i erase my unused diskspace with this options:

so i erase unused space on my data partion. after the procedure i check the partition with Active@ File Recovery for Windows. And i must see that the File Recovery Tool find many many pics (jpg, bmp, gif...) and much more data.

how is it possible? the pics was normally deleted. without eraser.

I downloaded the trial version.

After doing a Quick Scan, you can then ask the program to look for just deleted files / active files or a combination of the two.

Are you sure you searched for deleted files only?

I've used Restoration, Recover4All, this above program, and a small handful of other recovery programs, and after a freespace wipe with Eraser I only ever see deleted files of the type I have mentioned in my above post ie 0KB sized files.

 

[DaMoNZL]

i erase my unused diskspace with this options:

so i erase unused space on my data partion. after the procedure i check the partition with Active@ File Recovery for Windows. And i must see that the File Recovery Tool find many many pics (jpg, bmp, gif...) and much more data.

how is it possible? the pics was normally deleted. without eraser.

From what I've picked up from using Eraser and from what I've read elsewhere, it seems that you should be protected if you deleted the files normally, because when you install and then use Eraser to overwrite the free space the information where those files had previously been should have been wiped completely.

When I clean my system this is what I do:

I begin first by using two registry cleaners with no programs open and I also disable any running apps via Task Manager (except for those Windows processes needed for normal operation). I also disable power and screensaver settings also.

I proceed to do a anti-virus and spyware scan.

I then use two programs to clean my system and they are CleanCache and CCleaner which are both freeware and they both claim to securely clean the system. If anyone can verify whether either of these programs work I'd appreciate it.

I then reboot at the conclusion of each cleaner and re-close any apps in the tray and the background. I then run eraser via the right click menu in Windows Explorer with 3 pass and all boxes ticked by default.

After it has cleaned C drive, I immediately do a defrag of my system and then reboot and use my PC.

Now doing a 35 pass scan is can take hours and is generally not recommended since I have read that a 3 pass will do the trick.

Now keep in mind that this is what I do and that whatever way you do it should be fine.

I hope you can find a way to fix your problem and that your system is as secure as mine is.

 

[Carver]

Hi, Carver!

It seems to me that freespace is freespace - whether generated prior or subsequent to Eraser installation (I could be wrong, I'm no expert).
. Pete

Then I was missinformed, I read that was true.

 

[garrett01]

All,

When you delete a file in explorer the file allocation is just marked as freespace on the disk. This is why recovery programs can recover the data.

If you do a freespace erase all the 'data' of that file is wiped. However the recovery utilities will restore a file the same size as the original. If you examine this file you will see it is just rubbish.

If you erase a file from within eraser the file entry is overwritten with random data. Recovery apps can only see empty or random entries.

Garrett

 

[OFFRENT]

i erase my unused diskspace with this options:

so i erase unused space on my data partion. after the procedure i check the partition with Active@ File Recovery for Windows. And i must see that the File Recovery Tool find many many pics (jpg, bmp, gif...) and much more data.

how is it possible? the pics was normally deleted. without eraser.

I also have deleted files showing up on the drive after doing a free

space wipe. I have wiped the free space with Eraser plus a Freeware

program and a trail copy of a commercial program. None of the

freespace wipes removed the files.

I used 'FileRecover', trail version, from PCTOOLS to scan the drive

after doing a freespace wipe. After running the recover program it

shows a list of files on supposedly unallocated clusters that can be

recovered. This file recover program in trail mode will not restore

any files, but it does allow you to preview image files it lists as

recoverable.

Well after doing a wipe of freespace I ran the recover program and

it listed a bunch of deleted files. Guess what folks, these were not

just the file names, I COULD PREVIEW the image files. Most of them

appeared to be almost completely intact and some of the files

appeared to be undamaged by the freespace wipe.

I have to add that the files that were listed by the recover program

were files that were deleted the normal way by me or by the

operating system. No files that were erased by the Eraser were

listed by the recover program.

My opnion is that the operating system tagged the files as deleted

in the MFT, but the clusters are not being deallocated and that is

why Eraser is not wiping them. The recover program states that its

listed files are found on unallocated clusters, but that may be in

error. The problem appears to be something with the actions taken on

the MFT records. This could be an issue with the operating system or

the hard drive operation.

The fact is that files remain even after a freespace wipe by Eraser

and the other wiping programs. The disk IS NOT CLEAN !!!!

Hardware: 3 year old laptop, 20 gig hard drive
Operating system: Windows XP Home

 

[tateu]

OFFRENT,

Did you empty the trash first? If the files are in the recycle bin they may not (and probably do not) get overwritten by a freespace wipe.

 

[OFFRENT]

Good point, but I do not use the recycle bin.

 

[spy1]

No files that were erased by the Eraser were

listed by the recover program.

That I understand and totally agree with.

The fact is that files remain even after a freespace wipe by Eraser

and the other wiping programs. The disk IS NOT CLEAN !!!!

The two statements totally contradict each other (obviously - having done multiple tests myself with a different "recovery" program - I disagree with your second statement).

I'll try your program (the trial version of FileRecover) out in a couple of days to see if I get the same results (no recoverable/viewable data after a proper Eraser free-space wipe). Pete

 

[garrett01]

are you using an undelete application? e.g Norton unerase?

Garrett

 

[OFFRENT]

No files that were erased by the Eraser were

listed by the recover program.

That I understand and totally agree with.


The two statements totally contradict each other (obviously - having done multiple tests myself with a different "recovery" program - I disagree with your second statement).

I'll try your program (the trial version of FileRecover) out in a couple of days to see if I get the same results (no recoverable/viewable data after a proper Eraser free-space wipe). Pete

What I was trying to say, if I understand you, is that only files that were deleted by means other than ERASER are showing up as recoverable after a freespace wipe. Files that I specifically erased with eraser are gone. For instance files created temporarily by an application and then removed by the application when I close the application. These temp files do not show up in windows explorer, but they do show up as recoverable after a wipe. Also some of the files that keep coming back are jpegs that were installed by MS OFFICE which I just deleted not erased. So I do not think I am being contradictory. All files erased by ERASER are gone, but some files DELETED by an app or by normal manual delete keep coming back.

I also tried to say that I think I may be dealing with a situation peculiar to me. That is I may have a corrupt NTFS file system with clusters that are getting lost and not properly being tracked in the MFT files. Eraser will not overwrite clusters that the file system is indicating as still being in use.
That is simply putting it. If I have time I will use a HEX low level forensic editor to look at what may be happening.

I continue to use ERASER and will keep doing so. I just wanted to point out that I am getting these files that keep coming back from the dead.

 

[tateu]

I also tried to say that I think I may be dealing with a situation peculiar to me. That is I may have a corrupt NTFS file system with clusters that are getting lost and not properly being tracked in the MFT files. Eraser will not overwrite clusters that the file system is indicating as still being in use.

You have a slight misunderstanding of how Eraser works. It does not overwrite clusters, per se. It creates a ton of temp files to fill the available free space of the drive, it does not read the $Bitmap or MFT to create a cluster map and so it does not write directly to the free clusters, Windows ultimately determines which clusters get written to. If you have a 100GB drive that Windows reports has 20GB of free space, Eraser will keep creating temp files until Windows tells it not to and then it will delete them. This should result in the creation of 20GB worth of temp files. If you have jpg files that are not getting overwritten, then it could be, as you say, a problem with a corrupt drive or it could be something wrong with Windows itself.

 

[spy1]

Using File Recover and a quick run with Clean Disk (not Eraser), I can see what you're talking about. (See screenshot, here: http://www.wilderssecurity.com/showthre ... post880704 ).

I didn't know the File Recover program was going to take so long to run.

The only files that previewed with anything in them were all related to the OS itself - nothing else would preview.

I'll do an Eraser run when I shut down and see if the results vary. Pete

#It's quite possible that all that stuff gets re-generated whenever the programs involved are run - or that they simply never got deleted to start with, and thus weren't touched by Eraser.