Solved: I can recover "erased" files and files I have never deleted

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

northcape

Thread Starter
Joined
May 16, 2011
Messages
36
First off I am not at the programs own forum cos I cant recall either my pword or username so cant login or re-register. Secondly, you guys here will give me an unbiased opinion. I use a freeware version of a well-known file erase program. I have used it for years and thought I was safe. However, needing to recover accidentally deleted (not erased) files I used the recovery program from the same company. As well as the deleted files it turned up a whole load (all? I dont know, there were hundreds) of files that I had intentionally erased. including 7-pass and 35-pass erasures. At first my reaction was - "this program does not work as advertised", then "hmm, it it because of the way I am doing it?" When I have files to erase I move them to a temp folder and when convenient run the program. Does this mean that I am somehow creating a copy which stays in some archive or memory and it is these that are being recovered? Another odd thing: Using the file recovery tool I have "recovered" files that were never even deleted - but they were opened in grafix programs and altered, but NEVER deleted. Do these programs create their own library of used files and then "delete" them when the program or the pc is shut down? If I overwrite empty drive space with any old rubbish will that "sanitize" the drive? Thank you.
 
Joined
Jan 16, 2012
Messages
131
When I have files to erase I move them to a temp folder and when convenient run the program.
What happens in the above is that the OS "deletes" the old file location before copying the file to the temp folder for secure erasing. Thus, the undelete app is actually still seeing the old file that was never actually securely erased, and therefore letting you undelete it. In future, you should just do a secure erase of the files in their present location, without moving them anywhere first.

Using the file recovery tool I have "recovered" files that were never even deleted - but they were opened in grafix programs and altered, but NEVER deleted.
Some undelete apps will show normal files too, not just deleted files (such as Recuva).
 

northcape

Thread Starter
Joined
May 16, 2011
Messages
36
Thanks a lot, you confirmed what I was thinking. But I dont understand your "Some undelete apps will show normal files too, not just deleted files". Do you mean that they will show anything that was opened into other programs? For example - I combine 2 jpegs in PShop but do not save the file and do not delete the two originals: those originals show up in the "Deleted" search.
 
Joined
Aug 1, 2003
Messages
51,988
What OS are you using? Shadow copies are created in some for all deleted or moved (copied and then deleted) files. And there may also be restore points. Make sure that the program you are using is designed for use by Vista and 7 if you plan to use it for those operating systems. A lot has changed since XP. It is normal to have many copies of the same file on the drive. It all depends what OS and what version of NTFS you are using.

If files are symbolically linked, you need to simultaneously delete all links at the same time or the file remains completely intact, too. Most system files in system32 appear to be normal files but are really links.
 

northcape

Thread Starter
Joined
May 16, 2011
Messages
36
How come you guys can write in paragraphs and mine comes out all-joined-up, even tho I write it in paragraphs? So - should have said - XP. "Shadow copies" rings a bell: I recall asking about this and was told it doesnt happen. "Symbolically linked" is new - could you explain please? And what about files in an encrypted volume? If I erase them from within the volume will some kind of copy be spread all over Windows without my knowing?
 
Joined
Aug 1, 2003
Messages
51,988
XP doesn't make shadow copies, so that's not the problem with your situation. In Vista and 7, a copy is made of every file that is deleted or moved, so disk space can disappear from defragmenting.

Probably the best discussion of the nature and functions of symbolic links is HERE. Basically, they are functions of the NTFS file system whereby files and folders can have more than one address, so they appear to be in more than one place at a time even though they are really not. Some were used in XP, but Vista and especially 7 use them extensively. For example, for backward compatibility with XP, the location C:\Users\<username> is the same as C:\Documents and Settings\<username} in Vista and 7. So you will see folders at both those locations and they appear to be different but are really the same folders.

But none of those features seem to apply here. It looks like your software isn't erasing things as it should.
 
Joined
Jan 16, 2012
Messages
131
I dont understand your "Some undelete apps will show normal files too, not just deleted files".
Recuva has an option called "Scan for non-deleted files (for recovery from damaged or reformatted disks)."
So, it'll list non-deleted files for recovering, as well as actual deleted ones. I know, it can get confusing. :)
 

northcape

Thread Starter
Joined
May 16, 2011
Messages
36
"It looks like your software isn't erasing things as it should." I will run the program on the files in their original location (I always collected them into one place just for convenience) and see what happens. If they still re-appear then you are right - its not working. I will have to re-register under another name to get help at the site. Many thanks.
 

northcape

Thread Starter
Joined
May 16, 2011
Messages
36
I now erase files from their original location (rather than collecting them into another location) and as a result they no longer show up as "deleted files" when running a Recover program. Thanks for the help.
 
Joined
Aug 1, 2003
Messages
51,988
That way, there are no longer moved. Make sure that whatever program you use is compatible with Windows 7 or Vista. There have been many changes to newer versions of NTFS and System Restore since XP. A lot of files will not be removed by older software, but only doubled instead. Not exactly what you want to have happen when you click "delete".

You can mark your thread "solved" using the button at the top of the page.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top