Why can't I erase these files?

[thatman]

It's interesting to run a file-recovery program after running Eraser, just to gauge the efficiency of the latter. However, it's disconcerting to see a small list of files that can still be recovered despite using Eraser to erase Unused Disk Space on a HDD with a 3 pass overwrite. All the other options were ticked;
Free Disk Space (and Master File Table Records), Cluster Tip Area, and Directory Entries.

When using a (certain) file-recovery program, different results (files) show up when ticking the 'Physical drive' scan, as oposed to a non-physical scan.
So how is it that these files can be recovered. Or, more importantly why can't I erase them for good?

 

[Overwriter]

Hi thatman

Are you absolutely certain that the results you are getting from your data recovery programs are correct ?

Are they actually files that you have deleted and not simply the files Eraser uses to overwrite free space ?

Are you certain the files your recovery program is finding are not in your recycle bin ?

Are you certain that the files are not newly created and deleted temp files etc ?

As far as I know you will be the first person to be able to recover files overwritten with Eraser with a software recovery program since Eraser was conceived if your findings are accurate. If so, may I be the first to congratulate you !

Only joking about with you “thatman”. Although I suggest you double check your findings before making other new Eraser users worried. :wink:

 

[thatman]

Hi Overwriter,

When I was using Win98SE, it was satisfying to do a file-recovery 'test' before and after using an erasing program. And, sure enough, the only files that got listed after erasing were hundreds of temp files. This recovery thing has only arisen with Win XP. See this file-recovery screenshot that lists my drives.
http://i35.photobucket.com/albums/d152/ISO1/Recover.jpg

If I choose my (secondary) 'G' drive, physical, the recovery program immediately throws up a list of files, followed (in time) by all the overwritten temp files:
http://i35.photobucket.com/albums/d152/ ... ysical.jpg

If I then choose G: [no label], the temp files appear first. But the files that get listed in the 'physical' search do not show up.
http://i35.photobucket.com/albums/d152/ISO1/GDrive.jpg

It's the 'physical' search that's making me paranoid!

Are you absolutely certain that the results you are getting from your data recovery programs are correct ?

It's correct in that these files can be saved and viewed.

Are they actually files that you have deleted and not simply the files Eraser uses to overwrite free space ?

As you see from the screenshot, they're not Temp files

Are you certain the files your recovery program is finding are not in your recycle bin ?

I do erase my Recycle bin from time to time, but surely an
erasing program should include this in it's sweep.

As it's my secondary drive, I could try clearing it, reformatting, and do a complete wipe and see what happens. Any bets?

 

[Overwriter]

Hi thatman

I think I have seen this before. If you are using the pseudorandom option I think it just so happens that Eraser has made a file extension .txt or . jpg for example.

Also I wonder if your recovery program is listing active files on your hard drive, the ones you are using. Some commercial recovery programs do this.

Just as a test can you make a file called “thisisatest.txt” then write some text in it. Erase it and then try to recover it.

Thanks.

Just come back to this, have you been able to actually recover any of the file listed in your recovery program ? Or is it just random file names ?

Thanks again.

 

[thatman]

Have you been able to actually recover any of the file listed in your recovery program ? Or is it just random file names?

Yes some files can be previewed within the recovery program and recovered. The names are just JPEG_1, GIF_2, Text_3 etc. The text files contain info such as:

//-- Google Analytics Urchin Module
//-- Copyright 2007 Google, All Rights Reserved.

//-- UTM User Settings
var _ufsc=1; // set client info flag (1=on|0=off)
var _udn="auto"; // (auto|none|domain) set the domain name for cookies
var _uhash="on"; // (on|off) unique domain hash for cookies
var _utimeout="1800"; // set the inactive session timeout in seconds
var _ugifpath="/__utm.gif"; // set the web path to the __utm.gif file
var _utsp="|"; // transaction field separator
var _uflash=1; // set flash version detect option (1=on|0=off)
var _utitle=1; // set the document title detect option (1=on|0=off)
var _ulink=0; // enable linker functionality (1=on|0=off)

Also I wonder if your recovery program is listing active files on your hard drive.

A definite no, otherwise there would be lots more that I would recognise.

Just as a test can you make a file called “thisisatest.txt” then write some text in it. Erase it and then try to recover it.

I don't think I've ever recovered anything that I've previously wiped with Eraser. The 'recovered' files of this topic have probably been those that I've just deleted and not wiped.

On the subject of file-recovery, my system HDD started playing up a few months back. A Maxtor diagnostic floppy ran some tests and reported that the drive was about to fail, and urged me to copy the files from it. Finally, although the platter was still spinning, the drive refused to boot. I tried a file recovery program (the same one as before). It recovered thousands of files but, the downside was that many were duplicated over and over, were named as File0001, File002, etc, and many text files contained 'mixed up' text, with HTML wording in them. It meant opening up every one to see what they contained.

Then I tried a recovery program - it was brilliant. I was lucky that the drive held out, as it took 30 hours or so to each scan. But the program acted in a completely different manner to the previous one. It presents you with an explorer-like tree-structure of your files, so you can expand all your folders and tick off exactly which ones you want to recover - all complete with their original file names, and nothing was jumbled up. In my case, I can heartily recommended it.

 

[Overwriter]

Hi

The 'recovered' files of this topic have probably been those that I've just deleted and not wiped.

That is probably not so considering you said the following.

However, it's disconcerting to see a small list of files that can still be recovered despite using Eraser to erase Unused Disk Space on a HDD with a 3 pass overwrite. All the other options were ticked;
Free Disk Space (and Master File Table Records), Cluster Tip Area, and Directory Entries.

If you did perform the free-space wipe then there shouldn’t have been any files left to recover.

Would you please take the time to double check your findings please ?

Just perform a single pseudorandom pass on your drives free-space and check again with your recovery program. I am genuinely interested to learn of your findings.

On the subject of file-recovery, my system HDD started playing up a few months back. A Maxtor diagnostic floppy ran some tests and reported that the drive was about to fail, and urged me to copy the files from it. Finally, although the platter was still spinning, the drive refused to boot. I tried a file recovery program (the same one as before). It recovered thousands of files but, the downside was that many were duplicated over and over, were named as File0001, File002, etc, and many text files contained 'mixed up' text, with HTML wording in them. It meant opening up every one to see what they contained.

If your drive is faulty then Eraser may not be able to write to the disk properly during the pass. You drive needs to be physically destroyed.

I am sorry I had to edit your post a little as you made a reference to a commercial product.