Wiped File Names Still Visible - Is This Right?

P

prezz

New Member
Hi, sorry if this seems like a stupid question but I have used eraser to wipe the free space on my c drive using US DOD 7 passes and once its completed, using Disk Investigator 1.3, if I enter specific file names in the search option, I am still able to find clear references to specific files that should have been wiped (ie original filename & location). Is this normal or am I doing something wrong? If it is normal, am I able to delete these references to the wiped files, so if I search for a specific file name in Disk Investigator (or any other recovery program!) it wont return any hits? The references aren't to locked files that should have been wiped by the way.

Thanks in advance for any help!
 
prezz said:
Hi, sorry if this seems like a stupid question but I have used eraser to wipe the free space on my c drive using US DOD 7 passes and once its completed, using Disk Investigator 1.3, if I enter specific file names in the search option, I am still able to find clear references to specific files that should have been wiped (ie original filename & location). Is this normal or am I doing something wrong? If it is normal, am I able to delete these references to the wiped files, so if I search for a specific file name in Disk Investigator (or any other recovery program!) it wont return any hits? The references aren't to locked files that should have been wiped by the way.

Thanks in advance for any help!
Click to expand...

Can you be more specific about what you're finding with Disk Investigator? Are you finding file names in the Master File Table (where the actual directory listings would normally be found), or is it possible you're finding them somewhere else (e.g. in index.dat files that store system history, etc.)?
 
Hi, thanks for replying! To be honest I'm not sure where the files are, I'm simply typing in an exact filename for a number of different files (in Disk Investigators search option) that have previously only been deleted via the recycle bin (they werent anything important that needed secure destruction so no need to worry!), but then Eraser has been run on that drive using DOD 7 passes wipe free space option. The paging file is set to be cleared on shutdown & up till now, Webroot Window Washer has also been run on that drive set to clear everything ( internet history, cookies, index.dat, recent programs, recent files, etc) with 7 overwrites & file slack to be wiped. Not ideal I know but I've only just discovered Eraser!

As I say, after doing all this, when searching the drive with Disk Investigator, its still finding clear text entries for the filenames that I thought would have been overwritten/destroyed by now. I expect that the files themselves are irrecoverable (I havent checked that out yet) but the actual filename is still clearly visible when searched for. I'm sure that its down to me, but would like to be pointed in the right direction if possible!
 
Glenn said:
See "I did a Freespace erase and yet I can see the file names." in FAQ's http://www.heidi.ie/eraser/faq.php#Unused
Click to expand...

There seems to be some contrasting information on this. Though the FAQ says MFT entries aren't overwritten, the Help file says, during a freespace wipe:

Finally, the names of all previously deleted (or erased) files will be overwritten. On FAT{12,16,32} partitions this is done by going through all directory entries and overwriting deleted file entries. On NTFS partitions (Windows NT and 2000 only), Eraser creates maximum length files until the unused entries in the Master File Table are overwritten.
Click to expand...

It should be noted that the FAQ seems to refer to completely overwriting everything on the drive, rather than wiping freespace. So some clarification on this point, along with testing, is in order...
 
From the FAQ
I did a Freespace erase and yet I can see see the file names. What's going on?
If you erase a whole drive, Eraser will not clean the MFT/FAT. To do that you need to format the drive - think this is what BCwipe does. Formatting is the only way to safely remove the ghost entries from the MFT/FAT.
Click to expand...

This cant be right, Surely I dont have to format the disk after wiping the free space every time I want to securely erase a document!
 
Kythe is right ... there's conflicting info on the FAQ page. I also found:

I heard that Eraser doesn't wipe the filename when overwriting the rest of the file? Is this true? No. You can choose whether filenames are cleared or not, and Eraser can even clear names of all previously deleted files (when erasing unused disk space).

The article I first found may be for an older version.
 
prezz said:
Hi, sorry if this seems like a stupid question but I have used eraser to wipe the free space on my c drive using US DOD 7 passes and once its completed, using Disk Investigator 1.3, if I enter specific file names in the search option, I am still able to find clear references to specific files that should have been wiped (ie original filename & location). Is this normal or am I doing something wrong? If it is normal, am I able to delete these references to the wiped files, so if I search for a specific file name in Disk Investigator (or any other recovery program!) it wont return any hits? The references aren't to locked files that should have been wiped by the way.

Thanks in advance for any help!
Click to expand...
Maybe try East-Tec Eraser and check the option to scramble filenames & properties and see if that works for you or not.

http://www.east-tec.com/eraser/index.htm

I use that program and like it as it has more features. You can download a free 30 day fully working trial version. It costs more than I would like though.

It also supports many different wipe methods not found in other products.
 
I downloaded the evaluation version of East-Tec Eraser and found it to be disappointing. I ran Privacy Guard and all the deleted files were easily found in free space (CCleaner doesn't appear to securely delete files either, but that is free and just as complete for what it "deletes" eg temp files, index.dat, firefox cache, registry files - the only thing about E-T E is that you can custom add registry entries as well as files and folders). More shockingly, upon doing a free space wipe everything is still there and still recoverable (admittedly I only did a quick wipe with no verification). BC Wipe is similarly disappointing in that I can still undelete files even after a free space wipe. Only Eraser (Heidi's Eraser!) seems to work properly (I have Windows XP, SP2, NTFS). Running 1 PRNG pass on Eraser securely deletes all the previously deleted files still in free space.

My normal method of doing a secure wipe / clean of free space seems quite secure:

1. wipe custom files / folders with Eraser (using the On-Demand feature)
2. run CCleaner to remove other items, such as registry entries
3. Run BC Wipe Task Manager - Clear Recently Used Files List (it catches 1 or 2 things not caught by 2)
4. Run BC Wipe Task Manager - Wipe Special Folders Contents (requires restart) (it deletes the index.dat files) (this step isn't wholly necessary as it more or less duplicates 2. above)
5. Run MRU Blaster (it catches a small handful of things not caught above)
6. Run Eraser - Erase Unused Space

had East-Tek ran successfully all the tasks would have been covered by just the one program. I don't run all of the above actions everytime! I do 1-5 once a day and a free space wipe with 1 pass (PRNG) every 2 or 3 days with a 8 pass PRNG once a week. The 1 pass takes me about 1.5 hours and the 8 pass I do overnight.
 
Robbie said:
I downloaded the evaluation version of East-Tec Eraser and found it to be disappointing. I ran Privacy Guard and all the deleted files were easily found in free space (CCleaner doesn't appear to securely delete files either, but that is free and just as complete for what it "deletes" eg temp files, index.dat, firefox cache, registry files - the only thing about E-T E is that you can custom add registry entries as well as files and folders). More shockingly, upon doing a free space wipe everything is still there and still recoverable (admittedly I only did a quick wipe with no verification). BC Wipe is similarly disappointing in that I can still undelete files even after a free space wipe. Only Eraser (Heidi's Eraser!) seems to work properly (I have Windows XP, SP2, NTFS). Running 1 PRNG pass on Eraser securely deletes all the previously deleted files still in free space.
Click to expand...
Thats because "Privacy Guard" does NOT wipe free space. You have to use the "Erase Beyond Recovery" option for erasing free space, and slack space.

East-Tec is the best wiping program out there in my opinion. Just its interface isn't very user friendly in my opinion. I don't think they would still be in business all these years if they weren't actually over-writing files. I've used their software since 2002.

The Privacy Guard option does do deleting and overwriting of the files. I should also add that East-Tec Eraser is also the exact same program as Cyberscrub.

Also make sure you are using a higher wipe method than the default method. The locked files require the computer to reboot before they get overwritten.
 
I think my original post may have caused some confusion - I was referring to two seperate processes:

1. wiping the computer and internet files and tracks via Privacy Guard

2. wiping free space by using "Erase Deleted Data"

When I did a free space wipe with East-Tec I used the "Erase Deleted Data" option within the program - it's the same screen that launches when the "Wipe Free Space/Deleted Data" option is chosen when right clicking on the C drive in Windows Explorer. I did only do the Quick (1 pass) Erase as said, but it literally removed nothing from free space). Perhaps I need to try a more secure free space wipe method, but Eraser (Heidi's!) seems to do the free space wipe more securely, and with only one PRNG pass. I used a 7 pass DoD deleting method for Privacy Guard - but all the deleted files and folders remained in free space!

I must be doing something wrong. I left unchecked the "Use Isaac Random Generating algorithm". Should that have been checked? I really would like the East-Tec program to work, and I woukld glady pay for it (as I said it has everything I want in the one program, but I just couldn't get it to work as I expected).
 
I've tried it again - this time it wiped everything in free space (though it seems to leave more of its own temp files afterwards than Eraser does, and in different directories too). Perhaps I overlooked something last time around, though I did try a different Quick Erase wipe this time. As said, the interface is slightly user unfriendly, but it just took a bit of getting used to.

I think I will definately buy this and use this in conjunction with Heidi Eraser, perhaps alternating the free space wipe between East-Tec Eraser and Heidi Eraser to see which I feel happier with.
 
Free space wipe

I`m sure that Sami when mentioning this problem recommended erasing free space then defragging and free space wiping again,to ensure that all file names are totally removed - as far as possible that is! The difficulty still is, surely,that you always have to be absolutely sure that you have got at everything that might be considered a security/privacy risk. I would consider that for most of us ordinary mortals,it is an impossible task,and the use of a PC should be moderated accordingly.
 
You must log in or register to reply here.
Back
Top