1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: I can recover "erased" files and files I have never deleted

Discussion in 'All Other Software' started by northcape, Jan 24, 2012.

Thread Status:
Not open for further replies.
Advertisement
  1. northcape

    northcape Thread Starter

    Joined:
    May 16, 2011
    Messages:
    36
    First off I am not at the programs own forum cos I cant recall either my pword or username so cant login or re-register. Secondly, you guys here will give me an unbiased opinion. I use a freeware version of a well-known file erase program. I have used it for years and thought I was safe. However, needing to recover accidentally deleted (not erased) files I used the recovery program from the same company. As well as the deleted files it turned up a whole load (all? I dont know, there were hundreds) of files that I had intentionally erased. including 7-pass and 35-pass erasures. At first my reaction was - "this program does not work as advertised", then "hmm, it it because of the way I am doing it?" When I have files to erase I move them to a temp folder and when convenient run the program. Does this mean that I am somehow creating a copy which stays in some archive or memory and it is these that are being recovered? Another odd thing: Using the file recovery tool I have "recovered" files that were never even deleted - but they were opened in grafix programs and altered, but NEVER deleted. Do these programs create their own library of used files and then "delete" them when the program or the pc is shut down? If I overwrite empty drive space with any old rubbish will that "sanitize" the drive? Thank you.
     
  2. vic2pc

    vic2pc

    Joined:
    Jan 16, 2012
    Messages:
    131
    What happens in the above is that the OS "deletes" the old file location before copying the file to the temp folder for secure erasing. Thus, the undelete app is actually still seeing the old file that was never actually securely erased, and therefore letting you undelete it. In future, you should just do a secure erase of the files in their present location, without moving them anywhere first.

    Some undelete apps will show normal files too, not just deleted files (such as Recuva).
     
  3. northcape

    northcape Thread Starter

    Joined:
    May 16, 2011
    Messages:
    36
    Thanks a lot, you confirmed what I was thinking. But I dont understand your "Some undelete apps will show normal files too, not just deleted files". Do you mean that they will show anything that was opened into other programs? For example - I combine 2 jpegs in PShop but do not save the file and do not delete the two originals: those originals show up in the "Deleted" search.
     
  4. Elvandil

    Elvandil

    Joined:
    Aug 1, 2003
    Messages:
    51,988
    What OS are you using? Shadow copies are created in some for all deleted or moved (copied and then deleted) files. And there may also be restore points. Make sure that the program you are using is designed for use by Vista and 7 if you plan to use it for those operating systems. A lot has changed since XP. It is normal to have many copies of the same file on the drive. It all depends what OS and what version of NTFS you are using.

    If files are symbolically linked, you need to simultaneously delete all links at the same time or the file remains completely intact, too. Most system files in system32 appear to be normal files but are really links.
     
  5. northcape

    northcape Thread Starter

    Joined:
    May 16, 2011
    Messages:
    36
    How come you guys can write in paragraphs and mine comes out all-joined-up, even tho I write it in paragraphs? So - should have said - XP. "Shadow copies" rings a bell: I recall asking about this and was told it doesnt happen. "Symbolically linked" is new - could you explain please? And what about files in an encrypted volume? If I erase them from within the volume will some kind of copy be spread all over Windows without my knowing?
     
  6. Elvandil

    Elvandil

    Joined:
    Aug 1, 2003
    Messages:
    51,988
    XP doesn't make shadow copies, so that's not the problem with your situation. In Vista and 7, a copy is made of every file that is deleted or moved, so disk space can disappear from defragmenting.

    Probably the best discussion of the nature and functions of symbolic links is HERE. Basically, they are functions of the NTFS file system whereby files and folders can have more than one address, so they appear to be in more than one place at a time even though they are really not. Some were used in XP, but Vista and especially 7 use them extensively. For example, for backward compatibility with XP, the location C:\Users\<username> is the same as C:\Documents and Settings\<username} in Vista and 7. So you will see folders at both those locations and they appear to be different but are really the same folders.

    But none of those features seem to apply here. It looks like your software isn't erasing things as it should.
     
  7. vic2pc

    vic2pc

    Joined:
    Jan 16, 2012
    Messages:
    131
    Recuva has an option called "Scan for non-deleted files (for recovery from damaged or reformatted disks)."
    So, it'll list non-deleted files for recovering, as well as actual deleted ones. I know, it can get confusing. :)
     
  8. northcape

    northcape Thread Starter

    Joined:
    May 16, 2011
    Messages:
    36
    "It looks like your software isn't erasing things as it should." I will run the program on the files in their original location (I always collected them into one place just for convenience) and see what happens. If they still re-appear then you are right - its not working. I will have to re-register under another name to get help at the site. Many thanks.
     
  9. northcape

    northcape Thread Starter

    Joined:
    May 16, 2011
    Messages:
    36
    I now erase files from their original location (rather than collecting them into another location) and as a result they no longer show up as "deleted files" when running a Recover program. Thanks for the help.
     
  10. Elvandil

    Elvandil

    Joined:
    Aug 1, 2003
    Messages:
    51,988
    That way, there are no longer moved. Make sure that whatever program you use is compatible with Windows 7 or Vista. There have been many changes to newer versions of NTFS and System Restore since XP. A lot of files will not be removed by older software, but only doubled instead. Not exactly what you want to have happen when you click "delete".

    You can mark your thread "solved" using the button at the top of the page.
     
  11. northcape

    northcape Thread Starter

    Joined:
    May 16, 2011
    Messages:
    36
    Still on XP. Many thanks.
     
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/1037874

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice