File Recovery Test

Tried something i hadn't about before HandyRecovery http://www.handyrecovery.com & got quite a shock

First of all i used 3 different cleaners in succession, 2 of which used 3 passes each. I then rebooted & did a Deep scan with HR. It found hundreds of deleted files/folders, of which this is just a small sample



Those are leftovers from my "EMPTY" Recycle Bin, & most could be viewed. Even some that indicated Poor recovery !

In other various areas were, amongst other things, lots of deleted PDF files. I successfully 100% Recovered one of these, the first i tried. Anyway you can only Recover one file per day with the 30 day trial version.

Now either,

A - I'm doing something/s wrong

B - All my Cleaners are garbage

C - Using more than one Cleaner at a time is self defeating

D - ?

If others could test it & see you find similar results =

 

Which cleaners (and settings) did you test?

 

Clean Disk Security = 3 Passes

CCleaner = 3 Passes

BleachBit = 1

As an instance, all the above had the Recycle Bin ticked for cleaning.

 

If, at any time prior to running the cleaners, you had emptied the recycle bin the "normal" way (i.e., without overwriting), then it makes sense for those remnants to still be there. Windows had probably already flagged the space occupied by the deleted files as overwritable free space. In that case, your wiping program isn't going to "see" any of those insecurely deleted files, therefore it cannot attempt to clean them. Your best bet is to do a full free-space wipe, and then try the recovery program again to see if the remnants are still there.

 

I looked at that one you listed and its quite confusing,it shows valid files as well as deleted,not as good as the one i have (WHICH IS FREE)

www3.telus.net/mikebike/RESTORATION.html

This one you can also DELETE FILES TOTALLY FROM THE DISK! (So they cant be recovered)

 

Shred any file the normal way, then try again. That should prove it's real effectiveness.

 

You can set it to show ONLY deleted

Never the "normal" way here. Always via the cleaners, so ?

Think i might try that

That too

 

Heh i didnt realise how worthless HANDY RECOVERY is bud!

I defragged my disk,I DID NOT SECURELY DELETE ANYTHING (just defragged) and then ran HANDY RECOVERY again.. IT DID NOT LIST THE FILES AT ALL!!

The one i have is FREE and lists all defragged files in C:\<unknown> (Which you can then delete permantly)


I cant believe they have the nerve to charge $49 for that crap..... Im glad i have restoration

 

I'm testing it now.

I ran the "normal" Handy Recovery scan this morning (after running East-Tec Eraser to wipe the entire C: Drive's deleted data with a 1 pass and 1 check with ISAAC PRNG, and then running the Privacy Guard to wipe all Browser caches, temp files, etc. Then I ran BleachBit.

So far, with "normal" recovery, Handy Recovery has shown only deleted files with zero bytes and bizarre filenames like GMRSFWGY and filetypes like DRQW file or EEZ file.

I have been running H.R's Extended Analysis with checkboxes limited to video picture and document filetypes for an hour now and it looks like it's going to take another 2 or 3 hours to complete.

I'll let you know the results.

 

After you do that buddy please try the one i listed and see what cha think

 

I have it downloaded, but it's likely to be a few days before I run it.

(Edit Actually, I ran it just now on my D: Drive while Handy Recovery is working on my C: drive.

It seems very fast, but I'm not sure that it has the deep scanning abilities of Handy Recovery. I'll take another look at it again, though, and thanks for the link.

Personally, I have used Recuva of a number of occassions before:

http://www.piriform.com/recuva

I'm no expert in this area.

 

OK, the Handy Recovery Extended Analysis has finished.

Here is something I don't quite understand because I requested the program to recover only Document, Picture, and Video filestypes.

It's a screenshot of what I know are Spybot Search and Destroy files.

 

The Recycle Bin was empty, apart from 3 instances of Desktop.ini in 3 separate folders:

(There had been nothing in the Recycle Bin for days before I ran East-Tec Eraser to wipe deleted data on the C: Drive).

 

So finally, here is what I asked Handy Recovery to recover: my deleted and overwritten Documents, Pictures, and Videos (incl. Flash)

The timestamps show that anything that was recovered was written to my C: drive only after the drive was wiped.

 

OK, so where does that leave us?

In the help file for Handy Recovery, in the topic "Extended analysis to find more files", it says, amongst other things: "When the search is finished, all newly found files will be placed to the "Unnamed Deleted Files" folder in the folders tree."

All the rest of this $$folder stuff in the left pane seems to recovered system or program files.

I must stress that I am not particularly knowledgeable about erasing and recovering deleted files, but personally, I wouldn't be too worried about the files you see in these $$folders, because I suspect that they are just system/program files which are generated and deleted automatically when Windows is running - Windows is in a state of flux when it's running - there are processes and services changing, starting, and stopping all the time, system files and folders being generated and deleted. Critically, I suspect the timestamps on these files are not reliable, given that some of my Spybot Search and Destroy files which were shown as recoverable were dated in 2003 - 6 YEARS before I bought this laptop.

 

Right but if those files WERE TOTALLY OVER-WRITTEN you couldnt recover them!

When i do a FULL DELETE with RESTORATION then look with HANDYRECOVERY,nothing is there!! (Which is what should happen)


Ah well........

 

But all the deleted files that I had erased with East-Tec Eraser and BleachBit were totally overwritten.

That's why Handy Recovery couldn't recover any deleted files that had been deleted prior to the 22nd of October 2011.

Please look at the Unnamed Deleted Files section in the screentshots.

 

Could this be a case of cluster tips revealing file names?

Files no longer exist but the names and other identifying information may still be intact even after multiple passes of a secure deletion product

 

I am going to do another thread on a test that I did specifically looking for videos. But I did try Handy Recovery, and all it could pull up were deleted files names 5xxx, 6xxxx, 7x....and so on. All were the same size, and I think they were remnants left from the wiping utility that I used. I had to uninstall Handy though because it kept freezing up my laptop.

 

I knew it, you can't just recover overwritten files with everyday software.

 

Obviously, you know things about overwriting data.

But how do you think it is that the only deleted files that Handy Recovery could recover were the files I had deleted after running the wiping programs

Handy Recovery recovered no deleted files on my hard drive which had been deleted before I ran full wipes with East-Tec Eraser and BleachBit, on 22 October 2011.

Any deleted files which H.R. could recover were in the afternoon of 22 October - AFTER I had wiped everything.

By the way, East-Tec Eraser can overwrite not just the deleted files themselves; it also scrambles already deleted filenames, (so that Monica Lewinsky.doc becomes something like lDjw!svW.jfiltz as viewed on the Hard Drive.

Other good overwriting programs do this as well; I am not advertising East-Tec here; you should always look for this capabiility, and more, in good file or disk wiping software. I'd like to go further on this, but maybe I'll leave it to my next post.

 

I can only agree 100%

 

I've just got one more thing to say; please have a look at


https://www.wilderssecurity.com/showthread.php?t=300890&page=3

Similar topic.