Recuva Test: Deleted Video Files

Discussion in 'privacy technology' started by caspian, Oct 24, 2011.

Thread Status:
Not open for further replies.
  1. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    I wiped my hard drive recently with R-wipe and then out of curiosity, I ran Recuva for images. I found two images that should have been wiped. However, I did have my external HD connected at the time so I thought that Recuva may have picked those images up from there. So next, I disconnected the external hard drive and ran Recuva (deep scan) for videos. And to my amazement, there were several videos left. I ran Eraser and it did not get rid of them either. I then wiped the C drive with Ccleaner and it got rid of some of them. So I then decided to download a trial version of BCwipe and give it a try. BCwipe got rid of them all.

    I did another experiment with a USB stick. I could not get R-wipe to recognize the USB stick, so I used Ccleaner. Ccleaner did not get rid of all of the deleted videos, but it did get rid of some of them. I ran eraser, and it failed as well.

    So I then decided to see what would happen if I filled the USB stick almost completely with a truecrypt folder. I created one large enough to cover almost all of the remaining free space and then ran Recuva's deep scan. The videos still showed (screenshot below). It said that they were overwritten by the Truecrypt folder that I had named c4, but the size and the names of the videos were still there.

    1.jpg

    So I then ran BCwipe and all of the videos disappeared.

    I then did an experiment with 3 videos that had not been deleted on my USB stick. I right clicked on one video with Eraser and wiped it. And then I right clicked on two other videos and wiped them with R-wipe. The undeleted video that I wiped with Eraser did not show up with Recuva's deep scan. But the two videos that I wiped with R-wipe showed. And they were not overwritten. I recovered one of them and played it on my desktop. But as before, on both my laptop and my USB stick, BCwipe completely removed all video files where R-wipe, Ccleaner, and Eraser failed.
     
  2. Dude111

    Dude111 Registered Member

    Joined:
    Sep 30, 2008
    Posts:
    212
    Excellent for BCwipe,it sounds as good as what i have! (Restoration (which allows you to completly "wipe" as you say deleted files))
     
  3. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,738
    File names are one thing. Can you even recover the content?
     
  4. x942

    x942 Guest

    I tried it and no. Can not recover anything. Just file names. I don't think CCleaner wipes file names if I remember correctly.

    The red circle means "damaged/unrecoverable".

    PhotoRec also fails but shows the File Names.
     
  5. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    I have recovered playable files after using R-wipe for sure. I will have to do some more deliberate experiments with each utility. I have actually meant to post about this for several months now but just haven't gotten around to it. I do quite a bit of downloading and have noticed this problem with video files before when I do an occasional free space wipe and defrag.. Some have been recoverable but most say that they are overwritten. But the file names are still there and the files themselves are still there. The same size as they were before overwriting. BCWipe is the only thing that has made them all completely disappear.

    I will do some more experiments and try to be more specific.

    Thanks to Clone Ranger for introducing Recuva. It is something that I can actually use. I have tried a couple of other programs but I don't understand all of that hexadecimal stuff etc...
     
  6. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Moo0 Anti-Recovery has the option to delete just filenames.
     
  7. Heimdall

    Heimdall Registered Member

    Joined:
    Jul 29, 2009
    Posts:
    185
    I'm not able to recover anything useful after using R-Wipe, regardless if I wipe the file directly, or simply delete the file through Windows, followed by a wipe of the free space.

    Test performed on an external e-sata disk
    Wiped with DBAN preceding the test
    Copied several files including 2 mp4 videos several jpgs and a couple of Word documents
    Windows 7 SP1 Ultimate x64
    Recuva x64 1.41.537
    R-Wipe & Clean 9.5
     

    Attached Files:

    • rw.jpg
      rw.jpg
      File size:
      74.7 KB
      Views:
      1,411
  8. x942

    x942 Guest

    I get the same result.

    @OP

    Are you wiping individual files or deleting them and wiping free space? If the first maybe some files are being left elsewhere on the File System. We all know how windows likes to store things.
     
  9. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,738
    I thought the newer Eraser versions have an option to randomize file names.
     
  10. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    The 3 files in my screenshot above were on a USB stick. Prior to overwriting them with a huge truecrypt folder (labeled c4, as shown), I right clicked on each file and wiped them with R-wipe. They were not even showing as overwritten before I used the truecrypt container. There was a 4th video file still left on the USB stick. I right clicked on it and wiped it with Eraser. That file disappeared. But the ones that are showing it says are overwritten with a truecrypt container. But they are still showing.

    But here is the thing. There are 2 things that I have noticed. There have been many video files on that USB. I use to use it to transfer downloads from one computer to another and then deleted the files to make more room.. So almost all of these files were wiped. Lots of files were wiped. But it seems as though there are a few files that somehow get stuck. I saw them on my desktop as well a few months ago, to my amazement. And I kept wiping free space but they still showed. Just those 2 or 3 stubborn files.

    What initially got me interested in this was one day I was uploading a bunch of movies from a truecrypt container. I have started storing all of my stuff in a truecrypt container so there are all kinds of movies and music files there. Everything that I have, in fact. When I upload movies and music to share, I transfer them over to another truecrypt container and organize them with a file to organize the names and links with until I am finished uploading and posting them. Then I delete them and run Ccleaner. So anyway, out of curiosity, I ran Recuva and found all kinds of deleted videos. I ran some wipe utilities and it got rid of most of them but there were 2 or 3 stubborn ones left that would not budge. So there seems to be something that causes them to be stuck. I used R-Wipe, Eraser, and then to my surprise, Ccleaner got rid of a few that the others could not. I don't know if this is an issue with Vista or what. Right now I am either running Vista 64 bit or Vista 32 bit.

    It also seems to depend on how long the video files have been there. I just tried another experiment with this Vista 32 bit laptop. I created 3 folders. I put video files in each one. I deleted the video files in one folder, I wiped the videos in the next folder with R-Wipe, and the last folder with Eraser. After 3 restarts, I ran Recuva. And none of those video files were there. Not even the deleted ones. They must have been stuck in the recycle bin or something because when I ran Ccleaner later, it showed them being wiped. This was after 4 restarts.

    I put some more videos on my USB stick and will play them and leave them on there for a while and see if that makes a difference.

    When I get back home I will run recuva on my desktop. I can't remember if I re-installed before or after I discovered the stubborn video files (on my real HD, not truecrypt, from a long time ago). I also have some older USB sticks at home too so if some videos show up there, I will take some screenshots, before and after.

    But there is not mistake. This is not the first time that I have discovered stubborn video files that would not disappear after wiping the free space with both R-Wipe and Eraser. And in this last case, BCWipe was able to get rid of these last videos completely, where the other utilities could not.
     
    Last edited: Oct 26, 2011
  11. Noob

    Noob Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    6,491
    I've used Recuva with awesome results. (I once recovered over 2k photos for a friend, it took me a whole day, i mean seriously hours and hours) :D
     
  12. Longboard

    Longboard Registered Member

    Joined:
    Oct 2, 2004
    Posts:
    3,238
    Location:
    Sydney, Australia
    @Caspian
    Interresting.

    OOI which version of Eraser.
    Did you bring this up at Eraser forums or point them here ??
    Ther are many known issues with 'erasing' files on USb flash drives: this is an old thread from Heidi
    http://www.heidi.ie/forum3/viewtopic.php?f=2&t=1568
    Are your HDs SSD or platters ?
     
  13. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    I used Eraser 5.86 first, and then I downloaded the latest version and ran it too.

    No. I have never posted there. But I did see this post from a guy who could not get rid of a stubborn video file. http://www.heidi.ie/forum3/viewtopic.php?t=8207 It seems like something can cause a video file to get stuck, while all of the other ones disappear. And it seems like the longer a video file is there, the more likely it is to get "stuck". At least that is what I am thinking.

    This just makes me think that I should encrypt all of my USB sticks. It's kind of a hassle to enter a password but not too much of a hassle. I tried this on one of my USB sticks and it has worked really well so far. I am wondering something though. I noticed that with my encrypted USB stick, if I go to my computer and click on the drive letter, it wants me to format the disk. I am wondering if I encrypt a used USB stick and then reformat it, will that get rid of any personal data? I have my doubts. From the screen shot above, you can see that these video files were overwritten with a truecrypt container (labeled C4), yet they are still visible.

    I am embarassed to say that I do not know. My primary external drive is a Seagate. And I also recently bought a smaller one, Western Digital. And I have encrypted the entire Western Digital drive. I am going to use it as extra storage in case something happens to the other one. The other one has a huge truecrypt folder on it. But I think I will encrypt that entire drive too. The USB stick that I tested with is old and I can't even read the brand name on it. My computers are all HP.
     
  14. LockBox

    LockBox Registered Member

    Joined:
    Nov 20, 2004
    Posts:
    2,328
    Location:
    Here, There and Everywhere
    Just a thought, Caspian..... it would be interesting to see what would happen with these stubborn video files if you simply renamed them before deletion. Change nameofvideofile.avi (or whatever) to nameofvideofile.txt.
     
  15. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,168

    it's amazing
    because once i did a short test , i moved a file in the recycle bin , delete and another test clean with ccleaner

    used getdataback and r-studio and recuva nothing :(
     
  16. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    That would be interesting. But I think to do that I would just have to start renaming everything because it's impossible to know which video will get stuck. I may start doing that just to see.
     
  17. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    Yeah. I would say that 99% of everything gets wiped. But after tons and tons of videos sometimes one or more get stuck and won't budge. It doesn't seem to be a problem with other file types.
     
  18. x942

    x942 Guest

    If you are using an SSD ware-leveling may have taken effect. If this is so you may NEVER be able to over right the data affected. The issue with SSD's is they haven't been out long enough to know if data can be wiped properly.

    If it is a HDD maybe data is in a bad block? Not sure. I can not replicate the issue.
     
  19. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,168
    did you try to delete files online using eraserdrop or eraser ?

    was you able to recover?
     
  20. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    I did use Eraser to wipe free space. And the files were not playable after eraser. But I was able to recover them to my desktop. I had not heard of eraser drop until you mentioned it. I'll take a look. Thanks for the tip.

    But files that I have seen like this are files that were deleted a long time ago and just seemed to be stuck. Hundreds of other videos have been wiped.. The experiment that I did *above* was with a USB stick. What prompted me to do this experiment was an experiment that I did within a truecrypt container, where I found 2 video files that would not budge. But this was after using that container to upload tons of videos that were later deleted. I have 2 desktops at home so I will run recuva on them when I get home.
     
  21. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    This most recent try was on an old USB stick. So that may have been the problem. I did think it was interesting though that the videos in the screenshot above were left after I right clicked and wiped them with R-Wipe. The other video that I wiped with Eraser disappeared with no trace. The three videos above were fully recoverable until I covered them up with a truecrypt container. But as you can see they were still visible. I then deleted the truecrypt container, downloaded BCWipe and ran it, and everything disappeared.

    I am thinking maybe that's it. Thanks for you input.
     
  22. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,168
    thanks
    by the way recuva is a great software , so i installed it
    thinking i bought getdataback , the undelete feature is worse then recuva , i guess
    sure getdataback 4.25 has lots of more feature , very powerfull

    but my concern is about privacy , and the wipe action

    i'm thinking what should i do to delete for ever some files?

    thanks
     
  23. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,363
    Location:
    Oz
    I am thinking that maybe BCWipe is the best tool for wiping free space and wiping individual files.
     
  24. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,168
    maybe
    sadly it's not free
    with the demo version you can use only 1 pass
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.