File Recovery Test

Discussion in 'privacy problems' started by CloneRanger, Oct 21, 2011.

Thread Status:
Not open for further replies.
  1. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    Tried something i hadn't about before HandyRecovery http://www.handyrecovery.com & got quite a shock :eek:

    First of all i used 3 different cleaners in succession, 2 of which used 3 passes each. I then rebooted & did a Deep scan with HR. It found hundreds of deleted files/folders, of which this is just a small sample

    dc.gif

    Those are leftovers from my "EMPTY" Recycle Bin, & most could be viewed. Even some that indicated Poor recovery !

    In other various areas were, amongst other things, lots of deleted PDF files. I successfully 100% Recovered one of these, the first i tried. Anyway you can only Recover one file per day with the 30 day trial version.

    Now either,

    A - I'm doing something/s wrong

    B - All my Cleaners are garbage

    C - Using more than one Cleaner at a time is self defeating

    D - ?

    If others could test it & see you find similar results = :thumb:
     
  2. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Which cleaners (and settings) did you test?
     
  3. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    Clean Disk Security = 3 Passes

    CCleaner = 3 Passes

    BleachBit = 1

    As an instance, all the above had the Recycle Bin ticked for cleaning.
     
  4. CasperFace

    CasperFace Registered Member

    Joined:
    Jul 31, 2010
    Posts:
    200
    If, at any time prior to running the cleaners, you had emptied the recycle bin the "normal" way (i.e., without overwriting), then it makes sense for those remnants to still be there. Windows had probably already flagged the space occupied by the deleted files as overwritable free space. In that case, your wiping program isn't going to "see" any of those insecurely deleted files, therefore it cannot attempt to clean them. Your best bet is to do a full free-space wipe, and then try the recovery program again to see if the remnants are still there. ;)
     
  5. Dude111

    Dude111 Registered Member

    Joined:
    Sep 30, 2008
    Posts:
    212
    I looked at that one you listed and its quite confusing,it shows valid files as well as deleted,not as good as the one i have (WHICH IS FREE)

    www3.telus.net/mikebike/RESTORATION.html

    This one you can also DELETE FILES TOTALLY FROM THE DISK! (So they cant be recovered)
     
  6. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,516
    Shred any file the normal way, then try again. That should prove it's real effectiveness.
     
  7. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    You can set it to show ONLY deleted ;)

    Never the "normal" way here. Always via the cleaners, so ?

    Think i might try that :thumb:

    That too :thumb:
     
  8. Dude111

    Dude111 Registered Member

    Joined:
    Sep 30, 2008
    Posts:
    212
    Heh i didnt realise how worthless HANDY RECOVERY is bud!

    I defragged my disk,I DID NOT SECURELY DELETE ANYTHING (just defragged) and then ran HANDY RECOVERY again.. IT DID NOT LIST THE FILES AT ALL!!

    The one i have is FREE and lists all defragged files in C:\<unknown> (Which you can then delete permantly)


    I cant believe they have the nerve to charge $49 for that crap..... Im glad i have restoration :)
     
  9. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
    I'm testing it now.

    I ran the "normal" Handy Recovery scan this morning (after running East-Tec Eraser to wipe the entire C: Drive's deleted data with a 1 pass and 1 check with ISAAC PRNG, and then running the Privacy Guard to wipe all Browser caches, temp files, etc. Then I ran BleachBit.

    So far, with "normal" recovery, Handy Recovery has shown only deleted files with zero bytes and bizarre filenames like GMRSFWGY and filetypes like DRQW file or EEZ file.

    I have been running H.R's Extended Analysis with checkboxes limited to video picture and document filetypes for an hour now and it looks like it's going to take another 2 or 3 hours to complete.

    I'll let you know the results.
     
  10. Dude111

    Dude111 Registered Member

    Joined:
    Sep 30, 2008
    Posts:
    212
    After you do that buddy please try the one i listed and see what cha think :)
     
  11. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
    I have it downloaded, but it's likely to be a few days before I run it.

    (Edit:) Actually, I ran it just now on my D: Drive while Handy Recovery is working on my C: drive.

    It seems very fast, but I'm not sure that it has the deep scanning abilities of Handy Recovery. I'll take another look at it again, though, and thanks for the link.

    Personally, I have used Recuva of a number of occassions before:

    http://www.piriform.com/recuva

    I'm no expert in this area.
     
    Last edited: Oct 22, 2011
  12. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
    OK, the Handy Recovery Extended Analysis has finished.

    Here is something I don't quite understand because I requested the program to recover only Document, Picture, and Video filestypes.

    It's a screenshot of what I know are Spybot Search and Destroy files.

    Spybot - Search & Destroy Handy Recovery.jpg
     
  13. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
    The Recycle Bin was empty, apart from 3 instances of Desktop.ini in 3 separate folders:

    (There had been nothing in the Recycle Bin for days before I ran East-Tec Eraser to wipe deleted data on the C: Drive).

    Handy Recovery Recycle Bin.jpg
     
  14. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
    So finally, here is what I asked Handy Recovery to recover: my deleted and overwritten Documents, Pictures, and Videos (incl. Flash)

    The timestamps show that anything that was recovered was written to my C: drive only after the drive was wiped.

    Recoverable Deleted Documents.jpg
    Recoverable Deleted Pictures.jpg
    Recoverable Deleted Flash.jpg
    Recoverable Deleted Videos.jpg
     
  15. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
    OK, so where does that leave us?

    In the help file for Handy Recovery, in the topic "Extended analysis to find more files", it says, amongst other things: "When the search is finished, all newly found files will be placed to the "Unnamed Deleted Files" folder in the folders tree."

    All the rest of this $$folder stuff in the left pane seems to recovered system or program files.

    I must stress that I am not particularly knowledgeable about erasing and recovering deleted files, but personally, I wouldn't be too worried about the files you see in these $$folders, because I suspect that they are just system/program files which are generated and deleted automatically when Windows is running - Windows is in a state of flux when it's running - there are processes and services changing, starting, and stopping all the time, system files and folders being generated and deleted. Critically, I suspect the timestamps on these files are not reliable, given that some of my Spybot Search and Destroy files which were shown as recoverable were dated in 2003 - 6 YEARS before I bought this laptop.
     
  16. Dude111

    Dude111 Registered Member

    Joined:
    Sep 30, 2008
    Posts:
    212
    Right but if those files WERE TOTALLY OVER-WRITTEN you couldnt recover them!

    When i do a FULL DELETE with RESTORATION then look with HANDYRECOVERY,nothing is there!! (Which is what should happen)


    Ah well........
     
  17. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
    But all the deleted files that I had erased with East-Tec Eraser and BleachBit were totally overwritten. :)

    That's why Handy Recovery couldn't recover any deleted files that had been deleted prior to the 22nd of October 2011.

    Please look at the Unnamed Deleted Files section in the screentshots. :)
     
  18. jesusjesus

    jesusjesus Registered Member

    Joined:
    Jul 21, 2009
    Posts:
    61
    Could this be a case of cluster tips revealing file names?

    Files no longer exist but the names and other identifying information may still be intact even after multiple passes of a secure deletion product
     
  19. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    I am going to do another thread on a test that I did specifically looking for videos. But I did try Handy Recovery, and all it could pull up were deleted files names 5xxx, 6xxxx, 7x....and so on. All were the same size, and I think they were remnants left from the wiping utility that I used. I had to uninstall Handy though because it kept freezing up my laptop.
     
  20. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,516
    I knew it, you can't just recover overwritten files with everyday software.
     
  21. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
    Obviously, you know things about overwriting data. :thumb:

    But how do you think it is that the only deleted files that Handy Recovery could recover were the files I had deleted after running the wiping programs

    Handy Recovery recovered no deleted files on my hard drive which had been deleted before I ran full wipes with East-Tec Eraser and BleachBit, on 22 October 2011.

    Any deleted files which H.R. could recover were in the afternoon of 22 October - AFTER I had wiped everything.

    By the way, East-Tec Eraser can overwrite not just the deleted files themselves; it also scrambles already deleted filenames, (so that Monica Lewinsky.doc becomes something like lDjw!svW.jfiltz as viewed on the Hard Drive.

    Other good overwriting programs do this as well; I am not advertising East-Tec here; you should always look for this capabiility, and more, in good file or disk wiping software. I'd like to go further on this, but maybe I'll leave it to my next post.
     
    Last edited: Oct 23, 2011
  22. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
    I can only agree 100%
     
  23. Pryvate

    Pryvate Registered Member

    Joined:
    Jun 24, 2011
    Posts:
    56
Loading...
Thread Status:
Not open for further replies.