Recuva can recover if used right after Eraser?

[leowtyx]

1. I downloaded a picture from internet and then use Eraser to erase it with default one pass.
2. Right after that, I use Recuva to recover it. And Recuva shows the picture in its window with normal scan (not deep scan).
3. I downloaded the same picture from internet and use Eraser to erase it with default one pass. Then I restart my computer.
4. Then I use Recuva after the restart, Recuva cannot show the picture in its window with normal scan (I did not try deep scan).

So, my question is, if right after the second step where I try to scan for the file but not actually click recover, does that make the file goes back to the hard drive? Or I am safe to say the data is erased?

 

[Joel]

If Recuva finds the file intact without a deep scan, chances are a second copy of the file is lying somewhere on disk; most likely this is the copy found in the cache. Rebooting may cause the file reference to disappear as starting and shutting down creates quite a few files (and disk activity) and the MFT entry for the deleted file may have been erased by normal disk processes.

 

[DavidHB]

This is a classic example of the way in which security cannot be provided by any single operation. While, in this instance, I'd agree with Joel about the cache, on other occasions, shadow copies of files (if the function is enabled, which it is by default) can be the problem. Then, deleting unnecessary restore points, or (better) storing sensitive files on drives that have system restore disabled, or (best of all) explicitly erasing sensitive files rather than deleting them and erasing free space greatly improve the chances that the data you want destroyed is indeed beyond recovery.

David

 

[markmorgan]

The other issue is that Eraser has difficulty removing traces of a file on USB memory sticks / pen drives because of the wear levelling algorithms that they implement.

Mark.

 

[DavidHB]

The other issue is that Eraser has difficulty removing traces of a file on USB memory sticks / pen drives because of the wear levelling algorithms that they implement.

This is rather a different issue, which is extensively discussed in this thread. I think the agreed view now is that free space erasing will work on memory drives, but that individual file/folder erasing will not work. Because Eraser (or any similar program) works at the file system level, and (for rather obvious good reasons) cannot over-ride the wear levelling logic, there is not much that can be done to resolve this problem. As noted above, there are however means of helping Eraser to catch sensitive files on a standard hard drive.

David