Hi I have a question for people that know what their talking about. When i erase an image with Eraser through windows explorer right click "Eraser Erase" or through the recycle bin "Eraser Erase" I found I can easily recover the image with winhex or most of the time recuva. I use DoD 7 Pass E,C and E and Guttman but i just don't think Eraser is actually overwriting anything even though it may take awhile. I'm just disappointed I found that I could recover just about everything I thought I Erased. :?:
Images deleted from right click Erase are easily recovered
- Thread starter Mossey
- Start date
Re: Images deleted from right click Erase are easily recover
We always wish to investigate reports that Eraser has failed (or apparently failed) to erase files which were explicitly scheduled for erasure. There are a number of possibilities we know about, so it is best to get those out of the way first. Hence the following questions:
Just for clarification, the erasing method will make no difference in this situation. Also, having done extensive testing over the last couple of years, including using file recovery and sector editors as you have (quite rightly) done, I have yet to find a case in which Eraser, having completed a task, has failed to erase what it has been told to erase. What I have found is that it can often be incredibly difficult to find everything you need to erase. Behind what you see in Explorer a lot of other stuff can be invisibly lurking!
David
We always wish to investigate reports that Eraser has failed (or apparently failed) to erase files which were explicitly scheduled for erasure. There are a number of possibilities we know about, so it is best to get those out of the way first. Hence the following questions:
- What versions of Windows and Eraser are you using:
- What type was the drive in question - a solid state drive (flash drive or SSD) or a conventional spinning hard disk?
- Were System Restore and Shadow Copying enabled on the drive?
Just for clarification, the erasing method will make no difference in this situation. Also, having done extensive testing over the last couple of years, including using file recovery and sector editors as you have (quite rightly) done, I have yet to find a case in which Eraser, having completed a task, has failed to erase what it has been told to erase. What I have found is that it can often be incredibly difficult to find everything you need to erase. Behind what you see in Explorer a lot of other stuff can be invisibly lurking!
David
Re: Images deleted from right click Erase are easily recover
If those recommendations do not work, please could you come back with the answers to the questions, and details of what you did, step by step.
David
Joel got in ahead of me. This would be my first recommendation for a conventional (spinning) disk. For a solid state drive, the recommendation would be the same, but also to conventionally delete what you wish to erase first. Please use test files if necessary.Joel said:
If those recommendations do not work, please could you come back with the answers to the questions, and details of what you did, step by step.
David
Andreas Trapp
New Member
Hello David and everyone else,
I see this topic is quite old but it would be great to finish what was started.
To clarify, I've read the "common-eraser-questions-read-this-before-posting" topic and the "getting-to-know-eraser-6.6354" topic.
In short, I would like to delete some sensitive files from a laptop. To answer your (David's) questions from above (which the original poster left unanswered):
1) I am using Windows 8.1 and Eraser 6.2.0.2969
2) The laptop has both an HDD and an SSD. The files I want to delete are on the HDD
3) System Restore was enabled for the partition on which the files in question were stored. I went to System Protection for that partition and deleted the existing restore points. For Volume Shadow Copying (or specifically, File History since it's a Windows 8), this was already turned off.
Steps I took:
- deleted the restore points for the HDD partition where the files in question were located
- right-clicked on the files that I want to overwrite and "Erased" these files using Eraser
- I am about to initiate a wipe of all the free space on the HDD
Issues:
- my core partition is C. That's where Windows etc are installed. If I deleted (using the superficial right-click "delete" option) some non-core files from C, then I ran the "Erase Free Space" option on the entire HDD, did this also erase the free space in C (considering this is the core system partition) including the space where the aforementioned deleted non-core files used to be?
- is it possible for files to have been moved from the laptop's HDD to its SSD automatically/ without a user directing it?
- I saw you mentioned that copies of overwritten files may exist on "the paging file". What can be done about this?
- aside from the above, are there any other steps I need to take in order to make the target files irrecoverable?
- when using Eraser to permanently delete files on an SSD (by overwriting the entire SSD, are HPAs (or anything else) an issue that I should be aware of? That is, is it possible that some of the data on the SSD remains untouched by Eraser because that data is in an HPA?
I will do a test using file recovery software shortly, but first I wanted to hear your thoughts on whether anything else should be done to ensure the files in question are gone for good.
Thank you,
I see this topic is quite old but it would be great to finish what was started.
To clarify, I've read the "common-eraser-questions-read-this-before-posting" topic and the "getting-to-know-eraser-6.6354" topic.
In short, I would like to delete some sensitive files from a laptop. To answer your (David's) questions from above (which the original poster left unanswered):
1) I am using Windows 8.1 and Eraser 6.2.0.2969
2) The laptop has both an HDD and an SSD. The files I want to delete are on the HDD
3) System Restore was enabled for the partition on which the files in question were stored. I went to System Protection for that partition and deleted the existing restore points. For Volume Shadow Copying (or specifically, File History since it's a Windows 8), this was already turned off.
Steps I took:
- deleted the restore points for the HDD partition where the files in question were located
- right-clicked on the files that I want to overwrite and "Erased" these files using Eraser
- I am about to initiate a wipe of all the free space on the HDD
Issues:
- my core partition is C. That's where Windows etc are installed. If I deleted (using the superficial right-click "delete" option) some non-core files from C, then I ran the "Erase Free Space" option on the entire HDD, did this also erase the free space in C (considering this is the core system partition) including the space where the aforementioned deleted non-core files used to be?
- is it possible for files to have been moved from the laptop's HDD to its SSD automatically/ without a user directing it?
- I saw you mentioned that copies of overwritten files may exist on "the paging file". What can be done about this?
- aside from the above, are there any other steps I need to take in order to make the target files irrecoverable?
- when using Eraser to permanently delete files on an SSD (by overwriting the entire SSD, are HPAs (or anything else) an issue that I should be aware of? That is, is it possible that some of the data on the SSD remains untouched by Eraser because that data is in an HPA?
I will do a test using file recovery software shortly, but first I wanted to hear your thoughts on whether anything else should be done to ensure the files in question are gone for good.
Thank you,
Last edited:
Andreas Trapp
New Member
Hi David, Joel? I would very much appreciate your help with this.
Thanks in advance,
Andreas
Thanks in advance,
Andreas
egghead55425
New Member
I've used eraser in the past to hash empty space on my hard drive. I tried 6.2 the first time today and it totally trashed everything on my data hard drive on two Windows 7 64 bit computers! The OS tells me I need to format the drives to use them!
Andreas Trapp
New Member
Hi,
Quick update - I did an erase of the entire SSD (ie both used space and free space) and, same as for egghead above, once the erasing was done the OS said I need to format the SSD and recreate its partition(s) to be able to use it, which looks like a good sign.
HOWEVER, the computer has both an SSD and an HDD. I ran the "Erase Free Space" option on the entire HDD and then I did a search using Recuva for deleted files. Quite surprisingly, Recuva was able to locate a large number of 'deleted' files on the HDD. Some of these were marked as "irrecoverable/overwritten" but several others were recoverable and indeed I was able to restore them using Recuva. Many of these files had a "last modified" date that was several weeks, months or even years (!) earlier than the date when I ran the "Erase Free Space" operation.
Moreover, a large number of 'deleted' pictures was found (and recovered) by Recuva on the HDD, though both the pathway and the "last modified date" for these pictures were listed as "unknown".
Do you know what might be the problem here, ie why some files were left behind even though the "Erase Free Space" option was used?
Best regards,
Andreas
Quick update - I did an erase of the entire SSD (ie both used space and free space) and, same as for egghead above, once the erasing was done the OS said I need to format the SSD and recreate its partition(s) to be able to use it, which looks like a good sign.
HOWEVER, the computer has both an SSD and an HDD. I ran the "Erase Free Space" option on the entire HDD and then I did a search using Recuva for deleted files. Quite surprisingly, Recuva was able to locate a large number of 'deleted' files on the HDD. Some of these were marked as "irrecoverable/overwritten" but several others were recoverable and indeed I was able to restore them using Recuva. Many of these files had a "last modified" date that was several weeks, months or even years (!) earlier than the date when I ran the "Erase Free Space" operation.
Moreover, a large number of 'deleted' pictures was found (and recovered) by Recuva on the HDD, though both the pathway and the "last modified date" for these pictures were listed as "unknown".
Do you know what might be the problem here, ie why some files were left behind even though the "Erase Free Space" option was used?
Best regards,
Andreas
>>I ran the "Erase Free Space" option
The free space erase will not remove files in the recycle bin or in hidden partitions (system restore), and it relies on the directory table being intact.
Did you format the HDD and then try to erase free space and did the erase complete without any errors?
Try turning off any Anti-virus applications as these can interfere with erasing.
I just did the following test with the latest version of eraser on Sourceforge and the latest recuva from FileHippo
- ran recuva on a external drive - it detects a large number of 'recoverable' files
- ran a freespace erase
- ran recuva in advanced mode and all the space has been cleaned with only some 'rubbish' names veing found and these were not recoverable.
Are you able to try this sequence on your drive?
The free space erase will not remove files in the recycle bin or in hidden partitions (system restore), and it relies on the directory table being intact.
Did you format the HDD and then try to erase free space and did the erase complete without any errors?
Try turning off any Anti-virus applications as these can interfere with erasing.
I just did the following test with the latest version of eraser on Sourceforge and the latest recuva from FileHippo
- ran recuva on a external drive - it detects a large number of 'recoverable' files
- ran a freespace erase
- ran recuva in advanced mode and all the space has been cleaned with only some 'rubbish' names veing found and these were not recoverable.
Are you able to try this sequence on your drive?