Erased files still visible through Recuva search

O

OzJustin

New Member
Hi all

I'm new to Eraser and Recuva so please forgive me if I've overlooked something.

I cleared a 320gb external harddrive today in preparation to pass on to a friend.
I formatted the drive (under Windows 7 64) and then ran Eraser - unused disk space using British HGM (1 pass).
This took approximately 3 hours and seemed to complete fine.

I've just installed Recuva to confirm all my files are in fact permanently removed.
Running Recuva to search the drive for files, I let it run for maybe 12 minutes and cancelled as it was going to take 3 hours to scan. Despite cancelling, Recuva is showing at least 1000 filenames of files I had previously stored on my external drive. When I go to restore them the kb size fits their description but there is no data ie images won't show up, nor will mp3s play.

Can anyone tell me if filenames (without the data) should remain visible after using Eraser?
If not, what should I be performing differently to remove 'all traces' of files?

Thanks
 
The procedure you used is the correct one. What does the Eraser log say about the task? And was/is System Restore enabled on the target drive?

Eraser should have cleared the MFT, but so also should the format, so I'm a bit uncertain as to how the directory entries have survived; I have never had this happen. In your circumstances I would use disk management to remove the partition, create a new partition and run the free space erase again.

David
 
Thanks for the response David.

The Eraser log didn't seem to say anything about the task. It completed as normal.

System restore was not enabled on my external drive.

I have now deleted and recreated a simple volume in Disk Management and am re-running Eraser under the Pseudorandom (1 pass) setting. Will advise if Recuva picks any files names up the second time around. :)

Justin
 
Ok quick update.

Ran Eraser the second time through and checked with Recuva. It is still finding over 1000 files, however they are now random letter and number files names. This leads me to believe these are just files Eraser has written to the hard drive during overwriting.

The drive appears completely free of my files and filename history now.

Thanks :)
 
Good. This was the result I was hoping for (and cautiously expecting). You are correct about Recuva's findings, and they represent a good result, of course.

What I think happened with the original partition volume is that a reserve copy of the MFT somehow survived in protected form. Removing the partition also removed this protection, so that Eraser could overwrite the MFT data. The really good news is that we now have a tested solution if this problem crops up again.

David
 
Hopefully with the partition/drive erasure in 6.2 we won't need to do this...
 
Joel said:
Hopefully with the partition/drive erasure in 6.2 we won't need to do this...
Click to expand...
On the Island on which I live, there is a dialect word - "somewhen". I think it exactly specifies the release date of 6.2 ... :)
 
You must log in or register to reply here.
Back
Top