uncomplete erase

  • Thread starter Thread starter Anonymous
  • Start date Start date
A

Anonymous

Guest
hi
How come after I erased the unused hard disk, then i used "cia unerase" program to check deleted files, most of the files were still there. I used one pass, checked free space,cluster tips, and directory area options. Eraser didn't erase it completely. Can you show me how to do it? thanks
 
1. did you empty the recycle bin first?
2. did you actually recover the data or are you looking at 'ghost' entries in the directory structure?


Garrett
 
I able to recover everything using the "cia unerase". How come eraser doesn't erase "Master File Records"? If I use the 7 erased options, will it erase all the contents so "cia unerase" can't see and able to recover it? thanks
 
Just FYI, I have the same problem. I have run a full unused disk space erase successfully using Gutman wipe. I can still recover a lot of info using CIA unerase.

Anything that I actually erased is gone. It seems to be any data that was deleted before eraser was installed.

I'm using Eraser 5.6, XP SP1a.

Simon
 
>>I can still recover a lot of info using CIA unerase.

Directory entries or actual data?

Garrett
 
admin said:
>>I can still recover a lot of info using CIA unerase.

Directory entries or actual data?

Garrett
Click to expand...

Data - very briefly, after running a full Gutmann pass (35 passes, Files - cluster tips, alternate data streams. Free disk space & MFT, Cluster tips, directory entries) I can still see upwards of 40,000 entries.

It looks like all data actually erased using eraser is gone but any data not erased using eraser can be recovered. It takes a very long time (40+ hours) to run a full pass so I'd like to know if there is a fix (or a config change required) before trying again...

thanks

Simon
 
Simon said:
I can still see upwards of 40,000 entries.
Click to expand...
40000 entries of what exactly? Filenames?

any data not erased using eraser can be recovered.
Click to expand...
So if you create a file, delete it and then erase the unused disk space, are you saying you can recover the contents of that file?
 
Simon, could you possibly post a screen shot of the unerase program running, so we could see an example of what was found?
 
Anonymous said:
Simon said:
I can still see upwards of 40,000 entries.
Click to expand...
40000 entries of what exactly? Filenames?

any data not erased using eraser can be recovered.
Click to expand...
So if you create a file, delete it and then erase the unused disk space, are you saying you can recover the contents of that file?
Click to expand...

Yes - filenames. That's normally where data is stored...

Yes, create file, delete, erase unused space with all options and the file can still be recovered.

Simon
 
Anonymous said:
Simon, could you possibly post a screen shot of the unerase program running, so we could see an example of what was found?
Click to expand...

I can't post the image as I don't have access to a public http server to link from. If someone who has sends me an e-mail, I'll forward the image for posting.

I can be mailed at slime124@hotmail.com

Thanks

Simon
 
Simon said:
Yes - filenames. That's normally where data is stored...
Click to expand...
Right, but what's not entirely clear is whether you can recover the actual contents of the file, or simply the filename. The latter part would not be that serious.
 
Oh well, I now realize that your second answer probably was to the question about file contents, which you apparently can still recover. :shock:

In that case, could you perhaps tell more about your system. Does the partition have NTFS file system? How large was the file you still could recover, less than 4kB? Have you tried this with large files, any luck recovering their contents? What happens if you defragment the drive, can you still recover filenames?

Oh, and did you get any error messages when erasing the unused disk space?
 
Also, if I understood correctly, the trial version of "CIA Unerase" only lists filenames, and does not allow recovering (or recreating) the file. This makes reproducing this problem quite difficult without actually purchasing a copy of the program.
 
Sorry for being stubborn, but I just want to make sure there is no confusion here.

Simon, did you check the contents of the file after unerasing it to verify it matched the contents before the file was deleted? I mean, if Eraser simply fails to overwrite the directory entry for a file, the unerase program is able to recover the area where the file was stored, but the unerased file may very well contain only random garbage used for overwriting.

For example, if you download a ZIP file, store it on your hard drive, delete it, erase the unused disk space and then unerase the file, can you still successfully open the unerased ZIP file with WinZip? Oh, and when you try this, use only one overwriting pass, it's faster.
 
My experience with CIA Unerase

I decided to download a trial copy of the "CIA Unerase" program, and see if I could reproduce Simon's and Jack's results on my Windows 2000 system, using NTFS file system. Here are some of the observations I made, which I think might interest you.

First, I tried to restore a file I had deleted before erasing the unused disk space. Here's what I did:
  1. Deleted the file "ciauep_e.exe" I previously downloaded.
  2. Erased the unused disk space, one overwriting pass, no cluster tips.
  3. Ran "CIA Unerase".
To my surprise, "CIA Unerase" found 32318 deleted files on the drive. However, it did not find the "ciauep_e.exe" file I had just deleted. Nor did it find any of the temporary files Eraser created, although it should have. I also tested this with another program, "Restorer 2000", which couldn't find the "ciauep_e.exe" file either, but successfully located the temporary files as expected.

Anyway, one of the first things I noticed after running "CIA Unerase", was that most of the deleted files it found were listed multiple times. For example, it claimed to have found multiple deleted copies of the file "BD18239_.WMF". The really strange part is that "BD18239_.WMF" still exists on the hard drive, and has never been deleted. In fact, I picked a dozen random files from the "CIA Unerase" listing, and found every single one of them from the hard drive using the Windows file search. Why does this program list files that haven't been deleted?

I decided to give it another try, this time with a smaller file. Here's what happened:
  1. I created a small text file with known contents, and deleted it.
  2. Erased the unused disk space, same settings as before.
  3. Ran "CIA Unerase".
Well, the program told me it still found 32318 deleted files (!?), but again, not the file I had just deleted. "Restorer 2000" couldn't find the file either, and "WinHex" failed to find the contents of the file after scanning the entire drive. I think it is safe to assume the file is gone. Again, "Restorer 2000" found the temporary files Eraser created, "CIA Unerase" did not. It still apparently listed the same existing files it "found" the last time.

As my final test, I created another text file and deleted it. I did not erase the unused disk space afterwards. As expected, "Restorer 2000" found the deleted file, but surprisingly, "CIA Unerase" didn't. In fact, it told me it found "only" 32317 deleted files this time.

To sum it all up:
  • After erasing the unused disk space, I couldn't recover either one of the two files I had previously deleted.
  • "Restorer 2000" found the temporary files Eraser had created, "CIA Unerase" did not.
  • Based on my random sample, "CIA Unerase" listed a lot of files that still exist on the drive. Multiple times even.
For those interested, "Restorer 2000" can be downloaded here: http://www.restorer2000.com/, and WinHex here: http://www.winhex.com/.
 
Sami.....Just curious, do you rate Restorer2000 or Winhex over Directory Snoop from Briggs Software?
 
Well, "Directory Snoop" is an excellent program, but the last time I checked, it didn't support NTFS partitions. I only have a trial version of "Restorer 2000", but it definitely looks more trustworthy than "CIA Unerase". "WinHex" doesn't quite fit into the same category, but it's one of the best Windows hex editors I have come across.
 
You must log in or register to reply here.
Back
Top