Winhex not wiping free space properly or am I doing it wrong?

I used Winhex to recover some family vids that we accidentally deleted a year ago./ These were recovered using the Recovery by File Type option.

I then used the Initialize Free Space and Initialize Slack Space tools after which I once again ran the Recovery by File Type option.

I was surprised to see that the same "deleted" files where still there and recoverable. I ran Directory Snoop and Recuva but neither of them shows the same files.

Any ideas?

 

Hi and welcome to Wilders

I'm VERY surprised Directory Snoop didn't find something/s ?

They "could" be the same files but named differently ?

If they were deleted a year ago, i'm even more surprised that most if not all hadn't been overwritten by now

I might have a go with Winhex and see if can recover anything. Be nice if others could compare etc too

 

I have an old version of Winhex, but did you try "Initialize MFT Records"?

That's how you get rid of the record of a file with Winhex. Wiping the free space will overwrite the file (unless there is some bug with the new versions of the program), but it won't get rid of the record (unless the new versions are different).

Furthermore, on my version, you have to click "Take new volume snapshot" to show an updated snapshot of the drive in question. So, even after you've gotten rid of a record, you have to take a new snapshot.

Finally, are you sure the file is recoverable. Did you actually try to recover the file and play it (or otherwise confirm it). A record of a file does not imply the file is still there.

 

...ok I'm now thoroughly confused and more than slightly embarassed.

I performed a basic Windows file search (restricted to videos) and realized that the majority of the files Winhex showed aren't actually deleted. Including my "missing vids" (appears wifey moved them, renamed them and promptly forgot them).

This would explain why the files weren't visible via Directory Snoop but I'm curious as to why Winhex pull up these "non-deleted" files. The Recovery by Type only searches the free space correct?

 

Dunno.

With my version of Winhex, I've noticed some wacky things too, but I never investigated. It wasn't a priority for me.

Although, I will say, that I believe the free space wiping and MFT initializing features do work.

I haven't tested the file recovery thoroughly, although it hasn't always worked to my expectations. I haven't looked very deeply at it.

 

Have you tried EnCase Enterprise? It's used by law enforcement around the world.

If Recuva (the simplest and free) can recover your data, then I guess you need to increase the scrubbing method.