Unable to remove 10,185 deleted files which I assumed were in my hard disc free space.
eImage Recovery (Demo) has found 10,185 images and files on my hard disc. Some are damaged possibly due to overwriting but a vast majority have a clear preview picture of what can be recovered.
Because I do not recognise many of these pictures it seems that Windows is placing redundant jpg bmp png etc. images in this free space without my knowledge. Perhaps some are gifs of bars and buttons from web surfing.
What have I tried
I have tried using some of the more user friendly and ‘good reviews’ internet clearing tools available such as CCleaner / Drive Discovery / Active Privacy Guardian Washer 1.57 / Index.dat Suite / CleanCache / PurgeIE / IndexDat-Zap Version 1.05.
Why is eImage Recovery so different
The number of images that eImage Recovery displays are quite extensive and these seemingly cannot be removed by any of the normal space clearing methods available (below). Most of these only display a short list of deleted recoverable files in my free space area.
Active Privacy Guardian Washer / NShred / Super File Recover / Virtual Lab / Easis Data Lifesaver / NetSpring Data Recover / Back2Life / DiskDoctor / DIY Data Recover / Undelete Plus / Wundelete / Recover4All / Raise Data Recovery for NTFS / Recover data for NTFS / Arax Disk Doctor / Object Rescue Pro / Reviver / Stellar Phoenix data recovery / Data Recovery / Pandora / File Recovery / Recovery Files2 / Final recovery 2 / Directory Snoop / Undelete Plus / File Scavenger 3.1 / Clean Disc Security / Tune Up Utilities / Restoration / Blanccco File Shredder / BCWipe / Ace Utilities / Data Disk Recovery / Easy Soft / Undelete / PC Mesh / Win Hex Editor / Recover Lost Data / Eraser
So what else did I try
I have also wiped the free space several times using 4 different programs yet still these 10,185 files remain.
I first used Restoration to wipe the free space with 1 pass (I have now removed this program because it gave problems).
Blancco File Shredder to shred the free space using 7 passes. (nice piece of software)
Drive Discovery to shred the free space using 7 passes. (capable well written program)
File Shredder to shred the free space using 3 passes. (excellent basic free shredder with nice interface)
Finally, File Shredder to shred the free space again using the 35 pass Guttmann Algorithm.
I have also wiped the slacks, the file table entries and the system swap file.
Also, out of interest I downloaded a very interesting program called DiscFiller. I used this to nearly fill my free space with a massive 120gb file (leaving 40gb free and it is also very easy to remove the file filler later). Then I ran a free space wipe with Blancco File Shredder x7 plus slacks. After that thorough wipe I could still scan and display the original 10,000 ‘Internet’ files! There is a message here somewhere!
Tokiwa has produced a very simple and free DataRecovery program (he now has a later version 2.4.1 which I am evaluating). This program can also delete individual files from within the free space, but his program does not find all the files that eImage Recovery and DiskInternals do and is not tried and tested.
Tokiwa has confirmed that my 10,000 files being listed are likely to be web browsing temporary cache files that eImage Recovery is finding (already ‘deleted’ but not shredded I hasten to add).
How do I know that these files actually exist
There are only 2 programs that I can find which scan the system to show these files with preview pictures and these are ......
eImage Recovery (as mentioned above)
This is one of the best programs I have come across for viewing files in the free space without having to purchase it but DiskInternals has created a Virtual Partition on my C Drive to view the files it has found. When I contacted DiskInternals about it they said the folder / files have not been saved and can be removed by cleaning the free space. Not so! The folder is still there even after the 35 pass Guttmann wipe. This partition and folder now also exists on my hard disc which I cannot remove either.
What sort of files cannot be deleted
Some of these files I recognise as copy /paste activity between Firefox and Word. Other files are completely meaningless to me (see eImage Recovery 2 gif file - second picture). They seem to be images from internet sites. Other pictures are definitely from YouTube videos. One of the pictures I recognise as still in use is in My Pictures folder. The rest are music files and deleted photos and icons etc.
I do not think there is a particular problem with any of the tried and tested wiping programs as they all seem to produce the same result.
I think there must be other records kept by Microsoft somewhere that are not touched by General Internet Cleaning programs and wiping facilities.
I have also read somewhere that Office / Word 2003 records activity which cannot be detected in the normal way. I have since found the link. This is it ………. http://www.pcreview....hread-72052.php
Another thought I had was that the Clipboard might be applying records to the free space.
Here is an example of how deep seated the problem is.
I recovered a gif image to my flash drive that was showing in the DataRecovery deletion program from Tokiwa. When I opened it up the image showed a tiny paper clip. That paper clip is a little image that was applied to the subject of an email in Yahoo that I deleted, obviously to show that there were attachments to the message. I usually copy and paste any important emails like this to Word and save the information, so that gif image will have also been copied to the clipboard.
You need to have a forensic / computer brain to be able to work out how that image came to be listed in a recovery program!
I think that most programs do a respectable job at removing standard Recycle Bin and directly deleted files from the Free Space, including Eraser (but not version 5.82).
I also think that eImage Recovery and DiskInternals are reading parts of the disc space to find data that other cleaning programs are leaving behind.
What happens to data that is removed (but not shredded) by Privacy Programs?
What happens to clipboard images?
Do they all just magically disappear or do they go into yet another of Microsoft’s hidden folders never to surface again unless by forensic request.
I have attached a few screen shots to give you an idea of the sort of files being deposited in the free space.
Can you help
Sorry to ramble on so much but it is a difficult problem to put across and I wanted to give you the whole picture.
Simply, I just want to remove all the 10,000+ redundant files from my system and check that they have been removed.
I would also like the Virtual partition that DiskInternals has created removed as well.
Edited by crisoco33, 06 November 2007 - 06:03 PM.