Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Files!

I have been looking at image recovery programs to see what can be extracted from the free space after all the clearing operations have been implemented. Having seen the amount of information that can be recovered I will no longer empty the Recycle Bin without shredding the contents, but it seems that an enormous amount of information is still being collected which the normal individual is unaware of.

eImage Recovery (Demo) has found 10,185 images and files in my deleted free space area of the hard disc. Some are damaged due to overwriting but a vast majority have a clear preview picture of what can be recovered.
Because I do not recognise many of these pictures it seems that Windows is placing jpg bmp png etc. images in this free space without my knowledge.
I have tried using some of the more user friendly and ‘good reviews’ internet clearing tools available ………

CCleaner
Drive Discovery
Active Privacy Guardian Washer 1.57
Index.dat Suite
CleanCache
PurgeIE
IndexDat-Zap Version 1.05

The images that eImage Recovery displays seemingly cannot be removed by any of the normal space clearing methods available (see below).
I have downloaded on trial practically every recovery program known to man and it is quite alarming to note that most only display a short list of deleted files in my free space area.
There are only 2 programs that I can find which show an extended list of 'deleted' files with preview pictures and these are ......

eImage Recovery (as mentioned above)
DiskInternals Uneraser
and also VirtualLab Client which is a bit more complex.

To give you an idea how much effort I have put into this I have looked at all these programs in the hope of finding a tool that will wipe completely all the free space files beyond recovery and then check the free space after to see that no files are recoverable ......

Active Privacy Guardian Washer / NShred / Super File Recover / Virtual Lab / Easis Data Lifesaver / NetSpring Data Recover / Back2Life / DiskDoctor / DIY Data Recover / Undelete Plus / Wundelete / Recover4All / Raise Data Recovery for NTFS / Recover data for NTFS / Arax Disk Doctor / Object Rescue Pro / Reviver / Stellar Phoenix data recovery / Data Recovery / Pandora / File Recovery / Recovery Files2 / Final recovery 2 / Directory Snoop / Undelete Plus / File Scavenger 3.1 / Clean Disc Security / Tune Up Utilities / Restoration / Blanccco File Shredder / BCWipe / Ace Utilities / Data Disk Recovery / Easy Soft / Undelete / PC Mesh / Win Hex Editor / Recover Lost Data / Eraser

I have also wiped the free space several times using 4 different programs yet still these 10,185 files remain.

I have used Restoration to wipe the free space with 1 pass.
Blancco File Shredder using 7 passes.
Drive Discovery using 7 passes.
File Shredder using 3 passes.
Finally, File Shredder again using the 35 pass Guttmann Algorithm.

I have also wiped the slacks, the file table entries and the system swap file. Goodness knows what this is doing to my hard drive!

When I have shred every last evidence of computer internet activity, shred the Recycle Bin, Guttmann shredded the Free Space and removed all cookies and entries how is it possible for a basic recovery program like eImage Recovery to find so many records on my hard disc? I have not tried to recover any files because this is not possible with the demo program. It is not relevant anyway as the image content of the files which have not been overwritten are clearly visible and not marked as damaged.

I think there must be other records kept by Microsoft somewhere that are not touched by these wiping facilities.
I have also read somewhere that Office / Word 2003 records activity which cannot be detected in the normal way. I have since found the link. This is it ………. http://www.pcreview.co.uk/forums/thread-72052.php

Another thought I had was that the Clipboard might be applying records to the free space.

I have attached a few screen shots to give you an idea of the files being deposited in the free space.

Some of these files I recognise as copy /paste activity between Firefox and Word. Other files are completely meaningless to me (see eImage Recovery 2 gif files). They seem to be images from internet sites. Other pictures are definitely from YouTube videos. One of the pictures I recognise as still in use is in My Pictures folder. The rest are music files and deleted photos and icons etc.
One of the best programs I have come across for viewing files in the free space without having to purchase the product is DiskInternals but this has created a Virtual Partition on my C Drive to view the files it has found. When I contacted them they said the folder / files have not been saved and can be removed by cleaning the free space. Not so! The folder is still there even after the 35 pass Guttmann wipe. This partition and folder now also exists on my hard disc which I cannot remove.

I have been reading the postings on this matter and it was suggested that File Recovery Professional 3.2 was a good program to test the effectiveness of Wiping Facilities. I did not find this particularly helpful because none of the file names in the free space were original and there was no effective image preview facility like DiskInternals and eImage Recovery.

My mission is simple …….

Destroy all files in the free space beyond recovery. Test the Free Space to verify that this has been achieved.

Seems impossible! Do you have the answer?

http://i146.photobucket.com/albums/r257/crisoco/DiskInternalsRecoveredFiles.jpg

http://i146.photobucket.com/albums/r257/crisoco/eImageRecovery1.jpg

http://i146.photobucket.com/albums/r257/crisoco/eImageRecovery2.jpg

 

Well maybe you could have a career in a forensic data recovery company, because if you can recover all those files from an appropriately erased hard drive then you're a bit special.

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

Hi tradetime. Thanks for your input.
I do not consider myself special. In fact my internet technical knowledge does not extend to forensic hard disc recovery. That is why I am asking for help.
How would we know if the free space erasing programs are 'appropriately' erasing everything?
How do we know if the recovery programs are finding all the recoverable files?
I expect if we were to shell out mega bucks then we might have that re-assurance, but can we expect the same result from a free program?

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

Well mate, out of curiosity, and not having a lot to do right now, I just fired up my old laptop, downloaded your eImage, since I haven't used that before, and set it off on a scan.
Now I've had this laptop for about 7 years, wonder how many files it found............159.......that's right one hundred and fifty nine.
Of those it was able to produce a preview of 58. Now I don't know what you think of that. To me it is of no surprise since I erased that particular hard drive last month, the 159 files found were accumulated on a quick surf afterwards, most are gifs of buttons and bars from websites that are saved to your temp internet file everytime you go on the web, prolly at a rate of about 50+ per site.
Oh and the erasing proggie I use, Hiedi's Eraser., believe you've listed it in your above post, hence my comment, that if you can find 1000's of files after using it you gotta be special. Kinda sarcy, but meant to be funny, sorry if it offended.

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

Hi tradetime,
You have not offended me. I am not up on the mechanics like you are.
I have not done a check for 3 years on my system but have erased all the temporary internet files before doing the scan. I do not use Internet Explorer unless I have to so would all my Firefox temporary files be collected as well in the free space? I also see lots of bars and buttons from the internet in my eImage recovery list but also music files and other records which should have been deleted in the wipe. 10,000 is just too much! Your list is more acceptable. I do not like the latest version of Eraser because I understand it has some problems which were not in the previous version. I have enough troubles without adding to them. I have not even considered restore points yet!

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

I'm no computer expert, not like many of the folks who post here, just learning along the way.
I use version 5.6 and have had no problems, that is on XP though. I run an overnight free space wipe.

 

I been swiping hard with Heidi's Eraser product for years, when i first raised a stink at their forums my chief concern was hard drive deterioration over useage time of their wiping program. I was assured no problems would develop, and none ever has to my relief.

If the so-called deleted files were indeed overwritten sufficently then i might suspect Windows is keeping another hidden cache/duplicates someplace, but now when i use RESTORATION to "delete completely", i use UndeletePlus to prove whether or not they are indeed wiped again and reference removed such as file records. Beyond that, i have no idea what other software could surface anything readable let alone restorable, but i'm not so naive as to mention it's impossible either. There might be some sections of windows that record what these programs are about to do and cache them again, speculation, but begs to question, what if?

Microsoft is one of the most notoriously clever copying machines ever devised, it copies, records, storages all sorts of data in various places. Most of those have been identified so for as i learned.

Interesting, i like to look into this myself.

Continued discussions like this one surely will yield some positive experiences.

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

Due to the fact I was away for a few days Easter I have installed the programs you mentioned.Can all those programs be ran in safe mode and would they be more efficient this way.I'm like you and this is indeed a very interesting topic.

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

I was actually in the process of cleaning off my father's PC. I ran R-Wipe (only 1 pass with 0's). I then opened up Restoration. This is what I came up with.

http://tinypic.com/view.php?pic=2i1pd2e&s=2

I was reading this thread while running Restoration "delete completely." It was 51% finished so I stopped it just to see what this program would be able to pull up. It was unable to even show me what Restorarion was able to see. All that eImage was able to pull up were icons from desktop programs that I run. And I don't even understand why it was pulling those up. I had it checked for quickscan deleted files. So I definitely don't trust it.

 

10,000 files! Deleted Internet Temporary Cache or Clipboard records?

Thanks everyone for your input.
Caspian.
Have you tried DiskInternals Uneraser? It may find more than you think still on your father’s hard drive.
Caspian / Easter.
I do not trust Restoration any longer. It was giving me problems. I am not sure now what those problems were but have removed Restoration from my system.
I only use eImage Recovery to confirm that I have still got information on my hard drive that needs to be removed (currently about 10,000 files).
I take Caspian’s point about not trusting it but you have to admit that these programs are finding ‘deleted’ data which may or may not show that persons internet browsing history. Yes, it does pull up icons and buttons but surely not ones currently in use, only those deleted or copied to the clipboard?
Read the reviews at Download.com and all but one of the users were more than satisfied that it found the deleted images they were looking for.
Do not get me wrong here. I am not making a case in support of eImage Recovery but only to state that in my case it is finding data, some that I am aware of did exist and some that I am not aware of having viewed (could have been integral part of a deleted or cached download program). Apart from that DiskInternals confirms there is massive amount of ‘deleted’ data still lingering on my system.

Out of interest I downloaded a very interesting program called DiscFiller. I used this to nearly fill my free space with a massive 120gb file (leaving 40gb free and it is also very easy to remove the file filler later). Then I ran a free space wipe with Blancco File Shredder x7 plus slacks. After that thorough wipe I could still recover the original 10,000 Internet files! There is a message there somewhere!
It also proves that the Internet files are still being retained somewhere deep in the hard disc.
Tokiwa has produced a very simple and free DataRecovery program (he now has a later version 2.4.1 which I am evaluating). This program can also delete individual files from within the free space.
Tokiwa has confirmed that my 10,000 files being listed are likely web browsing temporary cache files that eImage Recovery is finding (already ‘deleted’ but not shredded I hasten to add).

Here is an example of how deep seated the problem can get.
I recovered a gif image to my flash drive that was showing in the DataRecovery deletion program from Tokiwa. When I opened it up the image showed a tiny paper clip. Now that paper clip is a little image that is applied to the subject of an email in Yahoo that I deleted. You need a forensic computer brain to be able to work that one out!

I think that most programs do a respectable job at removing standard deleted files from the Free Space (Recycle Bin clearing and direct deletion), but I also think that eimage Recovery and DiskInternals are reading parts of the disc space to find data that other cleaner programs are leaving behind.
What happens to data that is removed (but not shredded) by Privacy Programs?
What happens to clipboard images?
Do they just magically disappear or do they go into yet another of Microsoft’s hidden folders never to surface again unless by forensic request.

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

Hi Dave. I have not tried the program that you mentioned. But the eImage program only pulled up 77 items and they were all just icons and stuff. Have you tried R-Wipe yet? You can try it free for a couple of weeks. The first thing I do is check the IE section and then tell it to wipe. There are several areas included in that section. Then I do firefox and opera. Then I wipe system traces. there are about 30 areas listed there. Then application traces. That one includes all of your media players etc... Then I restart so it can get all of the slack files etc....then I wipe free space. Then if I use Restoration, it pulls up a bunch of unidentifiable remnants, which can be completely deleted fromn there.. I think you may want to try R-Wipe.

 

Sorry it made problems for you, it's nothing more than a standalone portable and i never experienced it even crash windows let alone anything else, but realize all systems differ and your particular setup may not gel with it like expected.

I installed DiskinternalsUneraser and find it pulls on my system very very hard in it's deep low-level scanning and i'm reluctant to allow it to finish for fear it might tear up my drive from the strain. Don't need that.

Anyway, irregardless of whatever wiper or recovery app we use, Windows plus our own daily useage will always pile up another list of embedded files & clusters no matter what. Windows is a very efficient copying machine as we all can attest to.

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

i tested:

eImage Recovery
DiskInternals Uneraser

on a small partition, with 100 mb, to avoid time waist.

and they can't recover deleted files, if i wiped the freespace with US DoD 3 passes. i used eraeser to do the wipe.

but interestinly i also made a trucrypt volume, and tried it in its virtuall parttition, even i think it is not needed, but i tried, and find out that eraeser can't completely wipe out the free space in truecrypt, there will be some files left over from last use.

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

Wow. I will have to do this experiment. I haven't tried eraser yet, but I have R-Wipe. If it doesn't work with truecrypt then that is not good.

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

Why would you worry about wiping free space inside of an encrypted vault?

 

Re: Restoration, Blancco, D/Discovery, File Shredder cannot wipe 10,000 Free Space Fi

Haha! That's a good question. I guess it doesn't matter. I do not have anything that is illegal so if law inforcement made me reveal it for some reason it would not matter. I guess it would just be interesting to know.

 

yes for security you don't needed to wipe it.

i did that, because TC can create a small partition very fast, it is good for testing.

and now i see, there may be a little bit differnces between the real partition from windows, and the virtual one from truecrypt.