Recuva is able to recover many intact files

[ranger]

Hi,

Last night I did a free space 1 pass pseudorandom erase on my C drive, including cluster tips and directory entries. The erase completed with a few errors, but I think the culprit files were all system files (located in the Windows folder). I then immediately ran Recuva on a deep scan for a couple of minutes, just to test. After a couple of minutes I cancelled the scan and Recuva had already found hundreds of pictures which were completely intact and recoverable. They were not random data, they were thumbnails of actual pictures.

I used Eraser 5.8.8.

Any ideas?

Thanks.

 

[DavidHB]

Well, at least it's not the fault of Eraser 6 ...

Search the forum on the term 'shadow copies', and read as much as you can (there's a lot) that seems relevant. You'll soon find that your results are not unusual.

We all initially fall into the trap of thinking that once a file is deleted and the free space erased, the file is gone. Sadly, the NTFS file system and other Windows features make the reality rather different. Shadow copies are the main but not the only culprit in this regard. Controlling how you use System Restore will reduce the problem very significantly.

I suggest running a normal Recuva scan, which will probably also find your deleted image files. Then see if you can use the Recuva option to overwrite them. If you can, that's one way round the problem. The best way is to use Eraser to explicitly remove any sensitive data, because file/folder erasing gets round the shadow copies problem.

David