Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

HARD DISC FREE SPACE? How do I wipe 10,000 unwanted deleted files?


  • Please log in to reply

#1
crisoco33

crisoco33

    Member

  • Member
  • PipPip
  • 21 posts
Windows XP Home.

Main Problem
Unable to remove 10,185 deleted files which I assumed were in my hard disc free space.

Overview
eImage Recovery (Demo) has found 10,185 images and files on my hard disc. Some are damaged possibly due to overwriting but a vast majority have a clear preview picture of what can be recovered.
Because I do not recognise many of these pictures it seems that Windows is placing redundant jpg bmp png etc. images in this free space without my knowledge. Perhaps some are gifs of bars and buttons from web surfing.

What have I tried
I have tried using some of the more user friendly and ‘good reviews’ internet clearing tools available such as CCleaner / Drive Discovery / Active Privacy Guardian Washer 1.57 / Index.dat Suite / CleanCache / PurgeIE / IndexDat-Zap Version 1.05.

Why is eImage Recovery so different
The number of images that eImage Recovery displays are quite extensive and these seemingly cannot be removed by any of the normal space clearing methods available (below). Most of these only display a short list of deleted recoverable files in my free space area.
Active Privacy Guardian Washer / NShred / Super File Recover / Virtual Lab / Easis Data Lifesaver / NetSpring Data Recover / Back2Life / DiskDoctor / DIY Data Recover / Undelete Plus / Wundelete / Recover4All / Raise Data Recovery for NTFS / Recover data for NTFS / Arax Disk Doctor / Object Rescue Pro / Reviver / Stellar Phoenix data recovery / Data Recovery / Pandora / File Recovery / Recovery Files2 / Final recovery 2 / Directory Snoop / Undelete Plus / File Scavenger 3.1 / Clean Disc Security / Tune Up Utilities / Restoration / Blanccco File Shredder / BCWipe / Ace Utilities / Data Disk Recovery / Easy Soft / Undelete / PC Mesh / Win Hex Editor / Recover Lost Data / Eraser

So what else did I try
I have also wiped the free space several times using 4 different programs yet still these 10,185 files remain.

I first used Restoration to wipe the free space with 1 pass (I have now removed this program because it gave problems).
Blancco File Shredder to shred the free space using 7 passes. (nice piece of software)
Drive Discovery to shred the free space using 7 passes. (capable well written program)
File Shredder to shred the free space using 3 passes. (excellent basic free shredder with nice interface)
Finally, File Shredder to shred the free space again using the 35 pass Guttmann Algorithm.

I have also wiped the slacks, the file table entries and the system swap file.

Also, out of interest I downloaded a very interesting program called DiscFiller. I used this to nearly fill my free space with a massive 120gb file (leaving 40gb free and it is also very easy to remove the file filler later). Then I ran a free space wipe with Blancco File Shredder x7 plus slacks. After that thorough wipe I could still scan and display the original 10,000 ‘Internet’ files! There is a message here somewhere!

Tokiwa has produced a very simple and free DataRecovery program (he now has a later version 2.4.1 which I am evaluating). This program can also delete individual files from within the free space, but his program does not find all the files that eImage Recovery and DiskInternals do and is not tried and tested.
Tokiwa has confirmed that my 10,000 files being listed are likely to be web browsing temporary cache files that eImage Recovery is finding (already ‘deleted’ but not shredded I hasten to add).

How do I know that these files actually exist
There are only 2 programs that I can find which scan the system to show these files with preview pictures and these are ......
eImage Recovery (as mentioned above)
DiskInternals Uneraser
This is one of the best programs I have come across for viewing files in the free space without having to purchase it but DiskInternals has created a Virtual Partition on my C Drive to view the files it has found. When I contacted DiskInternals about it they said the folder / files have not been saved and can be removed by cleaning the free space. Not so! The folder is still there even after the 35 pass Guttmann wipe. This partition and folder now also exists on my hard disc which I cannot remove either.

What sort of files cannot be deleted
Some of these files I recognise as copy /paste activity between Firefox and Word. Other files are completely meaningless to me (see eImage Recovery 2 gif file - second picture). They seem to be images from internet sites. Other pictures are definitely from YouTube videos. One of the pictures I recognise as still in use is in My Pictures folder. The rest are music files and deleted photos and icons etc.

Conclusion
I do not think there is a particular problem with any of the tried and tested wiping programs as they all seem to produce the same result.
I think there must be other records kept by Microsoft somewhere that are not touched by General Internet Cleaning programs and wiping facilities.
I have also read somewhere that Office / Word 2003 records activity which cannot be detected in the normal way. I have since found the link. This is it ………. http://www.pcreview....hread-72052.php

Another thought I had was that the Clipboard might be applying records to the free space.

Here is an example of how deep seated the problem is.
I recovered a gif image to my flash drive that was showing in the DataRecovery deletion program from Tokiwa. When I opened it up the image showed a tiny paper clip. That paper clip is a little image that was applied to the subject of an email in Yahoo that I deleted, obviously to show that there were attachments to the message. I usually copy and paste any important emails like this to Word and save the information, so that gif image will have also been copied to the clipboard.
You need to have a forensic / computer brain to be able to work out how that image came to be listed in a recovery program!

I think that most programs do a respectable job at removing standard Recycle Bin and directly deleted files from the Free Space, including Eraser (but not version 5.82).
I also think that eImage Recovery and DiskInternals are reading parts of the disc space to find data that other cleaning programs are leaving behind.

Finally
What happens to data that is removed (but not shredded) by Privacy Programs?
What happens to clipboard images?
Do they all just magically disappear or do they go into yet another of Microsoft’s hidden folders never to surface again unless by forensic request.

Attachments
I have attached a few screen shots to give you an idea of the sort of files being deposited in the free space.

DiskInternalsRecoveredFiles.jpg
eImageRecovery1.jpg
eImageRecovery2.jpg

Can you help
Sorry to ramble on so much but it is a difficult problem to put across and I wanted to give you the whole picture.
Simply, I just want to remove all the 10,000+ redundant files from my system and check that they have been removed.
I would also like the Virtual partition that DiskInternals has created removed as well.
Thank you.

DiskInternals_Recovered_Files.jpg eImage_Recovery_1.jpg eImage_Recovery_2.jpg

Edited by crisoco33, 06 November 2007 - 06:03 PM.

  • 0

Advertisements


#2
pip22

pip22

    Trusted Tech

  • Banned
  • PipPipPipPipPip
  • 2,663 posts
The files may be in your 'System Restore' points to which most eraser and wipe programs have no access as they are encrypted. To remove these you have to delete all your restore points:

Control Panel->System.
Click the tab 'System Restore'
Click the tick-box where it says "Turn off System Restore on all drives" and click 'Apply'.
Wait while Windows flushes the restore points.
Now untick the tick-box to re-enable System Restore and click 'OK'.

If I'm wrong, there is a way to definitely wipe the disk clean, but it wipes everything including the OS, so you would then have re-install Windows.
It's called 'Darik's Boot and Nuke (DBAN) and come as part of the free 'Eraser' program here:
http://www.heidi.ie/eraser/
It creates a bootable floppy with DBAN on it.

Edited by pip22, 07 November 2007 - 04:41 AM.

  • 0

#3
crisoco33

crisoco33

    Member

  • Topic Starter
  • Member
  • PipPip
  • 21 posts
Thank you for that thought.
I have already ticked the box to turn off system restore so it should not be picking up the images etc. from there. I am leaving it off altogether now because it did not work the last time I wanted to restore anyway.
I did this before I did any free space wipes.
I do not want to wipe the whole disc yet until I have explored all the alternatives.
While you were posting I was looking at the images that eImage Recovery was finding and my conclusion is that a lot of those images are from sites that I had no reason to even look at.
As an example there are perhaps 50 images of game controller icons which I have no interest in whatsoever, so somehow when I have been looking at icons for my desktop all these other icons are getting into the system somehow. I find it very very strange.
Perhaps the only answer is to pay for the full version of eImage Recovery and have a look in more detail at some images to see if it throws any more light on the subject.
There has to be simple answer to this as other users manage to clear the free space easily with a basic 1 pass wipe.
The clue is in all these images and how they get on my hard disc.
I have to say that each time I load eImage Recovery it finds different images and loads of the damaged images which were displayed previously no longer appear so things are moving about!
Weird!
  • 0

#4
The Skeptic

The Skeptic

    Trusted Tech

  • Technician
  • 4,075 posts
I am not familiar with the program you use but I can see that it's a recovery program. It might be that what you see is the number of files that can potentially be recovered by this utility. This does not mean that the files actually take any place on the disk. When you delete a file it is not actually deleted. instead, an instruction is sent to the file allocation tables to regard the clusters occupied by the files as "empty" and available to be overwritten.

This is how, basically, recovery programs work: they identify files that have been deleted, accidentally or intentionally, recover and copy them to a storage device. This is possible as long as the files were not overwritten.

You don't need anything more then to run Ccleaner, some good antimalware programs and defrag.
  • 0

#5
crisoco33

crisoco33

    Member

  • Topic Starter
  • Member
  • PipPip
  • 21 posts
Thank you for explaining the theory behind data recovery programs. I had a basic idea of what it was about but you have explained it perfectly.
I already have tried cleaning all the cookies, history, temporary files and so on with CCleaner and Active Privacy Guardian but to no avail.
I have had a yellow sticker in front of me for the past 2 weeks to remind me to defrag but have never got around to it because I wanted to get the hard drive in a 'reasonable' state before doing it.
By reasonable I mean clearing these so called entries in the MFT so that nothing shows to be recovered.

I have run the eImage Recovery program again and it now says that 12,635 images / music entries have been identified for recovery.

I have also downloaded and run their eData Recovery program and that is still running. I think it will still be running at Christmas unless I stop it.
It is showing a whopping 39,102 data files identified so far for recovery at 68% complete.
So, on a pro rata basis it will find 57,503 data files.

Add the two programs together and that makes 70,138 files that have been so called 'deleted'.

The thing is 80% of the files are not files that I would have even been associated with anyway, so I do not see that they have been deleted. Considering that I have applied a massive 120gb file to the free space in an attempt to overwrite the vast majority of these file table entries and also cleaned all records including the free space how can there still be that number of records available for recovery?
  • 0

#6
The Skeptic

The Skeptic

    Trusted Tech

  • Technician
  • 4,075 posts
I have no answer to the question at the end of your post. (I assume that the HD was always in your possession and no previous/other users were using it).

Had I been in your place I would have tried other recovery program to cross-check the one you use at the moment. You can try, for example (all free):

Undelete Plus
ADRC data recovert tools
Smart Recovery for Pictures
PCI file recovery

Try to run one of them, say, Undelete Plus, and see if there are real unrecognised recoverd files on such a massive scale.
  • 0

#7
crisoco33

crisoco33

    Member

  • Topic Starter
  • Member
  • PipPip
  • 21 posts
The hard disc has always been in my possession from new. No one else has access to it and the supplier is reputable (Evesham Technology) so I would assume that they had not dabbled with it to that extent except for testing.

I find the whole episode quite amazing.

I have already tried your suggestion about another program to confirm the results.
DiskInternals Uneraser has quite a good reputation and it also lists thousands of records.
VirtualLab Client is a very complex program and it also lists many records.

Now of the remaining programs I find they only list a small number of records.
I have looked at a selection from this list .........

Active Privacy Guardian Washer / NShred / Super File Recover / Virtual Lab / Easis Data Lifesaver / NetSpring Data Recover / Back2Life / DiskDoctor / DIY Data Recover / Undelete Plus / Wundelete / Recover4All / Raise Data Recovery for NTFS / Recover data for NTFS / Arax Disk Doctor / Object Rescue Pro / Reviver / Stellar Phoenix data recovery / Data Recovery / Pandora / File Recovery / Recovery Files2 / Final recovery 2 / Directory Snoop / Undelete Plus / File Scavenger 3.1 / Clean Disc Security / Tune Up Utilities / Restoration / Blanccco File Shredder / BCWipe / Ace Utilities / Data Disk Recovery / Easy Soft / Undelete / PC Mesh / Win Hex Editor / Recover Lost Data / Eraser

I see Undelete Plus is among this list.
I have had a look at the other 3 you mention on Download.com reviews.
ADRC seems a very basic recovery program so I doubt it will be any better than what I have tried.
Did you mean Smart Data Recovery 3.6? If this is the one it has some mixed reviews from excellent to poor and installs spyware.
PC Inspector seems to have problems loading into XP so I will give that a miss.

Thank you again for your continued support.
  • 0

#8
The Skeptic

The Skeptic

    Trusted Tech

  • Technician
  • 4,075 posts
The programs I use and recommend in the forum are all free so I believe there are some more elaborate programs to be gotten.

I never heard about a problem like yours. My opinion is that there is no way that such condition can occur unless the disk was written over and later deleted or quick formatted. I have no doubts about the integrity of your supplier but my feeling is (and this is a speculation only) that the disk was in use prior to the installation in your computer, possibly for backups. It may have been installed unintenationally in your computer.

Again, this is only a speculation.
  • 0

#9
crisoco33

crisoco33

    Member

  • Topic Starter
  • Member
  • PipPip
  • 21 posts
My suspicions were correct I think.
Today I downloaded a program called Digital Pictures Unerase 3.0.1.5 and it also listed the same sort of images as eImage Recovery.
You can only download the first 2000 with this evaluation version but it was sufficient for me to recognise that one of the images was of the program itself.
This image has come from download.com You will see that there is an image which can be enlarged. I have clicked on this image which is where the record is created. Nothing to do with deleted images!
I believe that most of the 10,000 images that are being found are not from the free space records but from elsewhere on the computer.
The problem has still to be resolved though .......
If all the history etc is removed
WHERE ARE WEB IMAGES / FILE TRANFERS ftp / CLIPBOARD RECORDS STILL HELD ON THE COMPUTER?
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP