Eraser failed to successfully erase a file?

C

chuckles1066

New Member
First post here and I'm not looking to start a flame war :D

I've used Eraser for many years and am currently using version 6. Very happy with it.......or so I thought.

I have nothing dodgy on my pc but I do use it extensively for a lot of my day-to-day activities, online banking, car insurance, house insurance, credit cards, you get the picture. So I wouldn't want those passwords getting into the wrong hands.

I stumbled across a freebie program called Recuva (http://www.piriform.com/recuva/download) and, seeing as I had a spare couple of hours thought I'd try it out. It claims to be able to recover deleted files.

So, I place an image of my cat on my d: drive, I then defrag the drive using Defraggler (from the same author) and then erase the picture using a 35-pass erase.

I then set Recuva off, using it's deep scan settings, and voila! There's a recovered picture of my cat staring back at me. I recover it to a separate drive and lo and behold it's revived from the dead.

I'm concerned?
 
Some more details would be helpful. What is your OS? Which build of Eraser were you using?

When you erased the file, what procedure did you use; the task pane, the context menu, or erasing the Recycle Bin? Can you reproduce, and describe step by step, what is happening? Does Recuva run in the background, and was it running when you did the erase?

We can guess at lots of things that may be happening. But, without precise knowledge of what happened and how it can be reproduced, it's not really possible to respond sensibly.

David
 
What's happened is that you defragmented the disk before you erased the file. Defragmentation moves file around the disk -- so your original single copy was duplicated (you did erase the duplicate). What you need to do is run an unused space erasure before running Recuva.
 
Thanks to both of you for responding so promptly.

Joel, I will try your suggestion later, I will document everything from start to finish and post back here.

David, I did the exercise on another machine, it's running Win 7 Home Premium 64 bit, the version of Eraser is the v6 currently available for download. I used the right click on file and Erase option from the Explorer context menu. I then ran Recuva in the background while I got on with other things.

I will endeavour to replicate it all later, I will try Joel's suggestion of erasing unused space first.

Joel: so defragging a drive is, in effect, a bad move if you have sensitive files on it?
 
Yes. Also leaving System Restore on -- that stores copies of files (shadow copies) automatically.
 
Ok, it seems the defrag process was the culprit as Joel suggests. Probably my own misunderstanding of what happens during a defrag contributed, I didn't know files got duplicated :oops:

I tried to replicate the event on this machine. Software used:

Win Vista Business SP2 32-bit
Eraser v5.88
O&O Defrag Professional v10 Build 1634
Recuva v1.35.472

A 1.36mb jpeg (size 1,434,457 bytes, size on disk 1,437,696 bytes) was placed on drive d:

Drive defragged using option Complete/Name (arranges files alphabetically on the drive)

Highlighting the jpeg from within Windows Explorer, right-click/erase
Options: 35 pass Gutmann

Recuva used, deep scan, file recovered completely. Able to copy the file to another location and view it.

To kill any noise on the drive:

Unused space erased from within Windows Explorer (right-click, erase unused space)
Options: 1 pass Pseudorandom Data
Free Disk Space ticked
Master File Table records ticked
Cluster Tip Area ticked
Directory Entries ticked

Same jpeg as before placed on d: drive

Highlighting the jpeg from within Windows Explorer, right-click/erase
Options: 35 pass Gutmann

Recuva used, deep scan, file not to be seen :)
 
chuckles,
I'm assuming that you know what a fragmented file is. Most defrag programs just copy and organize blocks of data to form complete files. They just copy blocks of data over other blocks without actually deleting the location it copied the block from. If a block of data was located in a higher position of the hard drive that is becoming free space, unless something else overwrites that block completely, that data will still be there. AKA you just made a copy of the data without realizing it. A normal user will never see the old data, but a program such as Recuva will.

That is why you need to erase the free and slack space.
 
I know I am ressurecting a dying thread, but my question is relevent, I believe. Can Eraser remove the remaining file names after doing a empty space erasure? As with the OP, I too used Recuva to do a deep scan after using Eraser, and it found 300000 file names and other objects listed. I am using Eraser version 5.7 and am not erasing cluster tips. Can Eraser be set to erase those file names as I have read on the Recuva forums? I am not saying that the data is recoverable, but I really don't want the names visible upon scanning.

Thanks in advance!

EDIT- I have since realized that many of the deleted files that Recuva has found after wiping with Eraser and marked as unrecoverable by Recuva are in fact recoverable, or at least to the extent which is unacceptable to me. Why is that happening? Should I be erasing the cluster tips? Is Recuva that GOOD?

Help, I must be doing something wrong!
 
Eraser 5 and 6 should erase the unused file names and replace them with garbage ones. I know for certain v6 does this for both FAT and NTFS. As you are using v5 I'd have to say that the code hasn't been touched for more than a year and so I'm no longer as sharp as I was with the v5 code and would probably not be able to help much to solve this.

Perhaps, you can try installing v6 and give it a spin and see if a similar issue occurs?
 
Would there be any advantage to erasing the cluster tips, and is there any harm that can come from doing that? I was told that there was some danger in having Eraser erase cluster tips. Please advise.

Thanks.

EDIT- I noticed on Eraser 5.7 that the checkbox "erase file names" under erase files is checked by default, however erasing file names is not an option for erasing unused space. Maybe that is the issue. How do you erase file names when erasing unused space?
 
I think the cluster tips problem has been solved for v6, I can't say the same about 5.7 as I wasn't with the project back then. Fundamentally, erasing cluster tips should be non-destructive and before/after states should be identical, it's factors like sparse files, encrypted files etc that mess the show.
 
BillSmith said:
I noticed on Eraser 5.7 that the checkbox "erase file names" under erase files is checked by default, however erasing file names is not an option for erasing unused space. Maybe that is the issue. How do you erase file names when erasing unused space?
Click to expand...
Joel didn't specifically answer this point, though the answer is implicit in what he said. Eraser 6, when doing a free space erase, also erases unused (including deleted) file entries as a matter of course, I believe after it has erased the free space as such and deleted the wiping files. I don't see the need for an option to omit this step; the file entries are as much part of free space as the deleted file clusters, and may themselves contain sensitive data.

David
 
I reran Eraser with the cluster tips setting and it was much more effective at wiping. Although it takes much more time. Would it be effective to only erase cluster tips occasionally, and generally erase free space without? I now understand that it erases the cluster tips of all existing files (hence the time spent) and I would imagine that unless you move those files around, such as when defragmenting, that those erased cluster tips remain erased. Am I correct in that assumption?
 
BillSmith said:
I reran Eraser with the cluster tips setting and it was much more effective at wiping. Although it takes much more time.
Click to expand...
The cluster tip erase should make no difference to the effectiveness of the free space erase (they are quite separate processes), so it may be that something went wrong with your first free space erase. It might be worth checking that you have not 'lost' any space on the drive and that none of Eraser's (randomly named) erasing files remain undeleted. More information on this is in the FAQ.

BillSmith said:
Would it be effective to only erase cluster tips occasionally, and generally erase free space without? I now understand that it erases the cluster tips of all existing files (hence the time spent) and I would imagine that unless you move those files around, such as when defragmenting, that those erased cluster tips remain erased. Am I correct in that assumption?
Click to expand...
Yes, you are correct, particularly with a non-system drive where, say, a data store resides, in which files remain unaltered for years. On a system drive, Windows and program updates, not to mention the operation of the page file (which can be on another drive, but is on the system drive by default) are always shifting things around. You will understand from all this why you need to erase free space after, not before, you defragment the drive. I also find that running the free space erase a couple of times on a non-system drive does improve the erasing results, though it does take a fair amount of time. And I think your idea of not erasing cluster tips on every free space erase has merit, as cluster tips are not so much of a security issue for ordinary users as recoverable deleted files.

David
 
You must log in or register to reply here.
Back
Top