That's probably because they were shadow copies and in space that Eraser did not see as free. The NTFS file system is a complex beast at the best of times, and a single Eraser run may well miss some items; it is very hard to be specific about this, because much will depend on other things that you did.
In these circumstances, Eraser is best regarded as part of a security system, rather than as the whole solution. I suggest the following :
- keep data on a drive or partition other than the system drive (which is always harder to clean completely);
- wherever possible, set programs so that they keep their logs, caches and catalogues etc on the data drive;
- disable system restore and shadow copies on the data drive;
- explicitly erase files you know are sensitive rather than deleting them and wiping free space, as Eraser will then know about any shadow copies and deal with them;
- when you test the erase (as you correctly did), use a file recovery program such as Recuva that can overwrite files you recovered; that, particularly in combination with the next Eraser run, will pretty much ensure that they are gone.
Incidentally, a single pass wipe used in the correct way is much more secure than a multiple pass that misses something. Which is why, for free space wiping, I use a single pass, in conjunction with Recuva as appropriate, and then repeat if necessary.
With a procedure such as this, you will find that a few separate Eraser runs to wipe free space will make your data drive progressively cleaner. Once Recuva (or whatever) is no longer finding recoverable files, you do not need to run the free space erase all that often. And the sensitive material will be gone. Irrecoverably.
David
