1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Shredding / Wiping software cannot wipe 10,000 Free Disc Space Files!

Discussion in 'Windows XP' started by davecrisoco, Nov 4, 2007.

Thread Status:
Not open for further replies.
Advertisement
  1. davecrisoco

    davecrisoco Thread Starter

    Joined:
    Jul 25, 2007
    Messages:
    6
    Windows XP Home.

    I have been looking at image recovery programs to see what can be extracted from the free space after all the cleaning operations have been implemented. Having seen the amount of information that can be recovered I will no longer empty the Recycle Bin without shredding the contents, but it seems that an enormous amount of information is still being collected which the normal individual is unaware of.

    eImage Recovery (Demo) has found 10,185 images and files in my deleted free space area of the hard disc. Some are damaged due to overwriting but a vast majority have a clear preview picture of what can be recovered.
    Because I do not recognise many of these pictures it seems that Windows is placing jpg bmp png etc. images in this free space without my knowledge. Perhaps some are gifs of bars and buttons from web surfing.
    I have tried using some of the more user friendly and ‘good reviews’ internet clearing tools available ………

    CCleaner
    Drive Discovery
    Active Privacy Guardian Washer 1.57
    Index.dat Suite
    CleanCache
    PurgeIE
    IndexDat-Zap Version 1.05

    The images images that eImage Recovery displays seemingly cannot be removed by any of the normal space clearing methods available (see below).
    I have downloaded on trial practically every recovery program known to man and it is quite alarming to note that most only display a short list of deleted files in my free space area.
    There are only 2 programs that I can find which show an extended list of 'deleted' files with preview pictures and these are ......

    eImage Recovery (as mentioned above)
    DiskInternals Uneraser
    and also VirtualLab Client which is a bit more complex.

    To give you an idea how much effort I have put into this I have looked at all these programs in the hope of finding a tool that will wipe completely all the free space files beyond recovery and then check the free space after to see that no files are recoverable ......

    Active Privacy Guardian Washer / NShred / Super File Recover / Virtual Lab / Easis Data Lifesaver / NetSpring Data Recover / Back2Life / DiskDoctor / DIY Data Recover / Undelete Plus / Wundelete / Recover4All / Raise Data Recovery for NTFS / Recover data for NTFS / Arax Disk Doctor / Object Rescue Pro / Reviver / Stellar Phoenix data recovery / Data Recovery / Pandora / File Recovery / Recovery Files2 / Final recovery 2 / Directory Snoop / Undelete Plus / File Scavenger 3.1 / Clean Disc Security / Tune Up Utilities / Restoration / Blanccco File Shredder / BCWipe / Ace Utilities / Data Disk Recovery / Easy Soft / Undelete / PC Mesh / Win Hex Editor / Recover Lost Data / Eraser

    I have also wiped the free space several times using 4 different programs yet still these 10,185 files remain.

    I have used Restoration to wipe the free space with 1 pass.
    Blancco File Shredder using 7 passes.
    Drive Discovery using 7 passes.
    File Shredder using 3 passes.
    Finally, File Shredder again using the 35 pass Guttmann Algorithm.

    I have also wiped the slacks, the file table entries and the system swap file. Goodness knows what this is doing to my hard drive!

    When I have shred every last evidence of computer internet activity, shred the Recycle Bin, Guttmann shredded the Free Space and removed all cookies and entries how is it possible for a basic recovery program like eImage Recovery to find so many records on my hard disc? I have not tried to recover any files because this is not possible with the demo program. It is not relevant anyway as the image content of the files which have not been overwritten are clearly visible and not marked as damaged.

    I think there must be other records kept by Microsoft somewhere that are not touched by these wiping facilities.
    I have also read somewhere that Office / Word 2003 records activity which cannot be detected in the normal way.
    Another thought I had was that the Clipboard might be applying records to the free space.

    I have attached a few screen shots to give you an idea of the files being deposited in the free space.

    Some of these files I recognise as copy /paste activity between Firefox and Word. Other files are completely meaningless to me (see eImage Recovery 2 gif file - second picyure). They seem to be images from internet sites. Other pictures are definitely from YouTube videos. One of the pictures I recognise as still in use is in My Pictures folder. The rest are music files and deleted photos and icons etc.
    One of the best programs I have come across for viewing files in the free space without having to purchase the product is DiskInternals but this has created a Virtual Partition on my C Drive to view the files it has found. When I contacted them they said the folder / files have not been saved and can be removed by cleaning the free space. Not so! The folder is still there even after the 35 pass Guttmann wipe. This partition and folder now also exists on my hard disc which I cannot remove.

    I have been reading various postings on this matter and it was suggested that File Recovery Professional 3.2 was a good program to test the effectiveness of Wiping Facilities. I did not find this particularly helpful because none of the file names in the free space were original and there was no effective image preview facility like DiskInternals and eImage Recovery.

    My mission is simple …….

    Destroy all files in the free space beyond recovery.

    Test the Free Space to verify that this has been achieved.

    Seems impossible! Do you have the answer?

    [​IMG]

    [​IMG]

    [​IMG]
     
  2. zabusant

    zabusant

    Joined:
    Sep 6, 2007
    Messages:
    2,584
    Give this one a go, select the DoD 7 passes, and then try and find something ;)
    http://www.tolvanen.com/eraser/download.shtml

    It should take hours and hours. However, the only real safe solution is to do a format - and then "erase" the whole drive.

    BTW, this is free and in my opinion, the best! Why so eager to get rid of your traces tho?
     
  3. davecrisoco

    davecrisoco Thread Starter

    Joined:
    Jul 25, 2007
    Messages:
    6
    Sorry Zabusant but I cannot bring myself to use Eraser, at least not at the moment. When it was taken over at version 5.82 I understand that a large number of users had there Windows screwed up because Eraser corrupted some important files when wiping the free space. I know they have sorted it in the later versions but I do not feel comfortable with that just now. I could try the previous 5.7 version which had good reports but that seems a bit of backward step to me.
    Thank you for your input though. I know you are trying to help and I am grateful.
     
  4. davecrisoco

    davecrisoco Thread Starter

    Joined:
    Jul 25, 2007
    Messages:
    6
    Further questions about Privacy Software, Internet Cache and Free Space Cleaning ………

    I only use eImage Recovery to confirm that I have still got information on my hard drive that needs to be removed (currently about 10,000 files).
    I have to admit that this program is finding ‘deleted’ data which may or may not show that persons internet browsing history. Yes, it does pull up icons and buttons but surely not ones currently in use, only those deleted or copied to the clipboard?
    If you read the reviews at Download.com all but one of the users were more than satisfied that it found the deleted images they were looking for.
    Do not get me wrong here. I am not making a case in support of eImage Recovery but only to state that in my case it is finding data, some that I am aware of did exist and some that I am not aware of having viewed (could have been integral part of a deleted or cached download program). Apart from that DiskInternals confirms there is massive amount of ‘deleted’ data still lingering on my system.

    Out of interest I downloaded a very interesting program called DiscFiller. I used this to nearly fill my free space with a massive 120gb file (leaving 40gb free and it is also very easy to remove the file filler later). Then I ran a free space wipe with Blancco File Shredder x7 plus slacks. After that thorough wipe I could still recover the original 10,000 Internet files! There is a message there somewhere!
    It also proves that the Internet files are still being retained somewhere deep in the hard disc.
    Tokiwa has produced a very simple and free DataRecovery program (he now has a later version 2.4.1 which I am evaluating). This program can also delete individual files from within the free space, but his program does not find all the files that eImage Recovery and DiskInternals do.
    Tokiwa has confirmed that my 10,000 files being listed are likely web browsing temporary cache files that eImage Recovery is finding (already ‘deleted’ but not shredded I hasten to add).

    Here is an example of how deep seated the problem can get.
    I recovered a gif image to my flash drive that was showing in the DataRecovery deletion program from Tokiwa. When I opened it up the image showed a tiny paper clip. Now that paper clip is a little image that was applied to the subject of an email in Yahoo that I deleted, obviously to show that were attachments to message. I usually copy and paste any important emails like this to Word and save the information, so that gif image will have also been copied to the clipboard. You need to have a forensic computer brain to be able to work out how that image came to be listed in a recovery program!

    I think that most programs do a respectable job at removing standard deleted files from the Free Space, including Eraser (Recycle Bin clearing and direct deletion) but I also think that eImage Recovery and DiskInternals are reading parts of the disc space to find data that other cleaner programs are leaving behind.
    What happens to data that is removed (but not shredded) by Privacy Programs?
    What happens to clipboard images?
    Do they just magically disappear or do they go into yet another of Microsoft’s hidden folders never to surface again unless by forensic request.

    Addition
    I have now managed to locate an internet forum where the problem of not being able to delete Microsoft Temporary Office files has been discussed. This is it …. http://www.pcreview.co.uk/forums/thread-72052.php
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/647768

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice