Unused space erase fail

O

oblue

New Member
Hi guys

I am not really sure if it was my fault or something to do with the Eraser so let me just tell you what happened. I have a seperate hdd in my computer. Today, I erased the unused space in it and when the job finished, I used a recovery tool to check out that the previously deleted files have gone forever. To my surprise, there were still files, many of them in good condition. I could even see the file names which should have been deleted.

I thought, those recovered files may be residing where the existing files are located, and that's why they couldn't be erased. So, I deleted everything from the D drive, and run the Eraser again to clean up the unused space, but no chance. The recovery tool was still be able to recover many files.

My question is, what should I do to erase those deleted files from the D drive completely so they cannot be recovered?

Many thanks in advance.

PS: I used US DoD with three pass.
 
The last 3 posts in this recent thread explain the situation. Unfortunately, it is not widely understood that erasing free space, on its own, does not necessarily remove all traces of previously deleted files, though it goes further in that direction than any other procedure. That is why I prefer recovery programs, such as Recuva, which themselves have an option to overwrite files they find.

David
 
David,

Thank you four answer. I checked out the posts you suggested where you say "non system drives are a lot easier to clean than system drives". Well, I was talking about a non-system drive where there are still files left after unused space cleaning. If Eraser is not capable of erasing unused space even in a non-system hard drive (because of the reasons you explained), what do you exactly mean by your comment?
 
What I meant is what I said. OK, so, though that's true, it's not helpful.

There is (pretty much) no such thing as empty space on a hard drive. Every cluster is filled with zeroes and ones. What users are concerned with are those sets of zeroes and ones that can be interpreted as meaningful information - in other words, files. A file exists as an entry in the file table pointing to the relevant clusters on the drive. When the file is deleted, the file system simple marks the entry as pointing to free space (I.e space that can be overwritten). The data itself is not removed. Over time, the drive contains more and more deleted files and fragments of files, and the entries in the file table (unless they are overwritten) continue to point to the location of the deleted files. How this affects individual deleted files is outside user control, and is to all intents and purposes random.

Eraser deals with this situation quite simply. It writes randomly named files full of random data to the drive until it is full, so that all the space marked as free by the file system is overwritten. It then deletes these 'garbage' files, and overwrites all the entries in the file table which point to free space. That way, all the free space is wiped.

How then can a file recovery program find deleted files on a drive on which all the free space has been erased in this way? The answer is twofold. Firstly, recovery programs can find the Eraser garbage files. As all they are is garbage, that is hardly an issue. Intelligent recovery programs like Recuva recognise such files for what they are and by default do not list them. If your recovery program does not do this, you will find a randomly named folder in the root of the target drive, containing randomly named files full of garbage most of which will be the same size. These are typically easy to spot, as almost no 'real' file names are completely random.

The second part of the answer is more of an issue. The fact is that copies of deleted files or part files reside in clusters on the drive that are not marked as free and which cannot be touched by the Eraser free space erase. Joel has explained this at some length on several occasions, but in summary shadow copies, journal entries and the page file all contribute to the problem. There is no way the user can completely prevent this happening, but the measures described in the post to which I linked will help considerably. If your concern is with a non-system drive, turning off system restore on that drive, and deleting all but the most recent Restore Points (CCleaner has a useful utility to do this, much easier to use than the one in Windows), then running a free space erase will probably make a big difference. If the recovery utility still finds files that concern you, use the utility to overwrite them; if it doesn't have this feature, use Recuva to do the same thing.

The bottom line is that Eraser works as advertised. But computer security is not a one stop shop. And the fact that Microsoft has designed file safety rather than data security into Windows leaves users vulnerable, particularly when they dispose of their machines. Future versions of Eraser will have a facility to erase complete non-system drives; a good plan will then be to back up the drive (preferably more than once), erase it completely, and then restore the backup. (You can in fact do the erase with version 6.0.8. by formatting the drive, then running the free space erase.) At that point, the free space will no longer contain remnants of deleted files.

I hope that this explains things.

David
 
You must log in or register to reply here.
Back
Top