Permanently wiping files and traces
Some user may have found that when using CCleaner Wipe free space function to wipe the deleted space, another product from this company called Recuva can still recovery this deleted files even though the data recovery program itself had marked these files as "previously overwritten". Why files can still be recovered even after a 3-pass overwriting on the deleted space?
User of tenforums "whiteliess " shared his story: ,
wiping free space on a drive - which I have done with ccleaner (with these settings: 1 and 3 pass, secure deletion, wipe mft free space, wipe alternate data streams). Since files are already deleted, he cannot use a secure delete tool as an alternative.
Coincidentally, another user from majorgeeks said:
How can this be possible? I did an advanced overwrite (3 passes). I selected the options: wipe entire drive and three passes. However, Recuva was able to recover 7 pdf documents in excellent condition, and I was able to read all the words in the pdf documents, despite I choosing 3 passes.
Let's find out why
1. What're the wiping methods: Open CCleaner and navigate to Tools > Drive Wiper, and click Free space only in Wipe area, and then click the drop down menu of security, we can see it has 4 wiping method listed: simple overwrite (1 pass), advanced overwrite (3 passes), complex overwrite (7 passes), and very complex overwrite (35 passes).
2. What're the wiping standards: We can see the very complex overwrite method adopts 35 passes, but is that the standard wiping methods from Peter Gutmann, or is that the Gutmann method, which involved writing a series of 35 patterns over the region to be erased. Besides, there're many algorithms using 3 passes and 7 passes, which standards are used in CCleaner for advanced overwrite and complex overwrites?
With these questions bearing in mind, I found the following explanation:
CCleaner has four methods of secure deletion: a Simple Overwrite (1 pass), DOD 5220.22-M (3 passes), NSA (7 passes), and Gutmann (35 passes). A 'pass' refers to how many times CCleaner writes over the spot on the hard drive. The more times CCleaner writes to that spot, the harder the file will be to recover by any means. The drawback is that it will take CCleaner longer to complete the job.
Please note this sentence:
The more times CCleaner writes to that spot, the harder the file will be to recover by any means.. The result turns to the "The harder" not "impossible" to recover data, so that's not CCleaner's fault if you failed to wipe out free space on your drives, he already made that clear or is Recuva so powerful that it can even recovery 3-pass wiped hard drive with ease? We'll try Recuva and test if it is competent to carry out the work.
1. Create some files on an empty drive, pics, video, pdfs, etc.
2. Select them all by press Ctrl + A and press Shift + Delete to "permanently delete" them.
3. Run CCleaner > Drive Wiper > Free space only > Advanced Overwrite (3 passes), which is DOD 5220.22-M. And select the drive we made for testing. Click Wipe and it will start to erase free space on this partition, no need to confirm or input some keywords to activate, it has no harm to the existing data.
4. Run Recuva and click In a specific location when it asks Where were the files and check the Enable deep scan to see if the files we deleted are listing in the window or not.
FYI: it took me 27s to wipe free space on a 1GB Drive I created for testing.
If you can still recovery the deleted files from Recuva, you can try Ccleaner alternative ByebyeData Eraser, with more than 4 wiping standard available data sanitation software. Here're the steps to of erasing free space:
1. Open ByebyeData Eraser and click Erase free space in the main window.
2. Check the Drive you created for testing, if you created more than one drives, you can check them all. ByebyeData Eraser will erase them all.
3. Now coming to the erasing standard column, choose one from it and click Erase Now to perform the erasure.