Garbage beyond a trash can!

[guns1inger]

If you used the link I provided you would have found the most recent version, which is 5.8

[daamon]

Well, using PC Inspector I have recover 20GB of data when my computer crashed, so its not that bad.

As long as you're happy - that's the main thing. I wasn't questioning it's ability to recover files, more the consistency of what it's reporting as deleted and hence available for recovery.

As for "Eraser", you reference version 5.3. The link guns1inger gave points to 5.8. I haven't looked into the differences.

[fLYtRap]

Okay, I installed eraser, but I am not sure if I got everything correct. It only shows how much unused data I have on drive c, but it doesn't show any details:

[Scorpion King]

This thread has got me thinking, problem is it has been so long ago my memory is pretty cloudy. ok.

A HDD has an index where file names are stored. Deleting a file does not do anything to the actual file on the disk, it simply rewrites the index. For instance the DOS v6 Undelete program (I think it was that V) would show the deleted filenames in that folder with a question mark replacing the first character in the name. You supply the first character and the file was undeleted. The disk location (track and sector block) that contained the actual file was uneffected by a simple delete, just the index that pointed to it. The index was simply labeled, by that one rewritten character, that the location was now freespace.

The first few characters in a track and sector block were the location of the next block, then the block contained the file or the part of the file that fills that block. If the remainder of the block was empty the OS could not use it. The rest of the block was filled with a character (I believe it was ALT-255). The character was the one used when formatting a new disk. The OS only needed one of those characters ( i believe) to mark the end of the file data then it would stop reading the block contents. The remainder of the block, if it had been used before, still contained the data from the last file or parts of more than one file depending upon the past usage of that block.

A program that is trying to erase a file is going to have 2 jobs to do. First it must erase the file name from the index, then go and write over the contents of the trace and sector blocks the file was using. And depending on what program will be used to recover the erased data, maybe do it many times.

Things has changed a little since I studied all this stuff. Blocks are now called 'allocation units' and instead of being 256 character in size they are now 4096 and up to what - 64,000!

My memory ain't just cloudy, it needs undeleted

Good luck.

[fLYtRap]

I started running erasing process, but when I was observing it, I saw that eraser was wipeing also windows protected files, so I stopped, because I wasn't sure about it.

[guns1inger]

What did you choose to erase ?

If you want to cleanup old deleted files, choose Unused Space on Drive.

[Nelson37]

Scorpion King, that explanation of file deletion is exactly correct.

The only difference would be that the actual character replacing the first character of the filename is not a question mark, that is just how it is displayed. I forget what the value really is, may be an ALT-255 or something else. The character marks that cluster as available for use, though the only change is that first character in the file name in the FAT.

As for the 7 rewrites to truly cover a file, I believe that number is a crapshoot based on the random effect of the new file covering all of the individual clusters used by the old file. If the new file is greater in size than the old, then the first cluster is guaranteed to be overwritten.
However there is no way to specify exactly what cluster out of all of those available is used. That is why file recovery tools should never be installed on the suspect drive, they could overwrite the very data you are trying to save. Subsequent used clusters may or may not be re-used based on their order of availability, which could be changed by a defrag, for instance. Any other file deletions or creations could also alter this.

It is my understanding that once a cluster is completely overwritten, just once, then the old data on that cluster is unavailable, at least to software tools.

[fLYtRap]

What did you choose to erase ?

If you want to cleanup old deleted files, choose Unused Space on Drive.

Did you see this screenshot above? Thats what is says, but when I was observing the process I was concern that eraser is doing to much.
I'm going to try this on a hard drive that I was going to reformat anyway and I'll do some experiments.

[Scorpion King]

Thanks Nelson

Here is what I started on ...

http://oldcomputers.net/pics/C64-left.jpg

Now you know whats wrong with me.

[fLYtRap]

Thanks Nelson

Here is what I started on ...

http://oldcomputers.net/pics/C64-left.jpg

Now you know whats wrong with me.

What the hell is that?

[Scorpion King]

Commodore C-64. 64k ram (32k free). No floppy drive, no hdd, no mouse, no monitor. I used a old 13" b/w tv. Mine was the deluxe version - - - it had a sound chip with like 8bits mono audio. Cool..

Me and the kids brought it home, hooked it up, and turned it on. It stopped booting to a blue screen with the words "READY" and a flashing cursor. We looked at each other wondering what it was going to do next, well it didn't do anything next. We had to go back to the store and buy a $200+ 5 1/4" floppy drive and some programs. Oh the good old days. haha

Good luck.

[3Simon7]

I accidently deleted a file that I need it, so I installed data recovery software in attempt to restore the file.

There was an undelete utility included with Windows a long time ago.
I think it was in Windows 3.11

There wasn't a recycle bin, just a File Manager.
The undelete utility would restore some or most of the deleted file.
I don't think any versions of Windows have that utility anymore.

I use "eDATA Unerase" to recover files that I delete by mistake.

By the way, to delete a file that can't be deleted, use "Dr Delete".
I've used "Dr Delete" to get rid of Spyware/virus files.

[fLYtRap]

I accidently deleted a file that I need it, so I installed data recovery software in attempt to restore the file.

There was an undelete utility included with Windows a long time ago.
I think it was in Windows 3.11

There wasn't a recycle bin, just a File Manager.
The undelete utility would restore some or most of the deleted file.
I don't think any versions of Windows have that utility anymore.

I use "eDATA Unerase" to recover files that I delete by mistake.

By the way, to delete a file that can't be deleted, use "Dr Delete".
I've used "Dr Delete" to get rid of Spyware/virus files.

Windows undelete was replaced by windows restore and some other third party softwares like for example GOBACK.

[Nelson37]

That undelete was not a Windows command, it was included with DOS, IIRC version 5 or 6. This was actually pioneered in Digital Research DOS 5, and before that was a part of the early Norton utilities.

Scorp, you go way back. First one I touched was a VIC-20, first one I owned was an early XT.
Knew an electronics tech who did work for Commodore, he used to rave about terrible build quality, one reason I never bought one.

[VegasBud]

I thought I'd add a little perspective on this topic, as briefly as possible. Please note I'll be talking about FAT disks, which is what I've had more experience with.

Each file (or subdirectory) has one entry in the directory structure, and one or more entries in the "File Allocation Table" (FAT). The FAT has one entry for each cluster (disk space allocation unit).

Each entry in the directory structure contains (among other things) the filename, the file size, and a pointer to the file's first FAT entry, whose corrsponding cluster contains the file. If the file occupies more than one cluster, the FAT entry is set to point to the next FAT entry, and so on, until the last FAT entry in the chain, which is marked by setting all the bits (FFFh to FFFFFFFFh depending on the FAT type being used).

When a file is erased, the first byte of the directory entry is changed to E5h, but the rest of the entry is left unchanged, which includes the pointer to the first FAT entry for the file. Erasing also zeroes out all the FAT entries in the chain so the disk space can be re-used. As a result, immediately after a file is erased, it's first cluster can still be identified, and the contents of that cluster can be accessed, but since the FAT entries have been zeroed, there's no longer pointers to the next cluster, and the next, etc.

It's kind of like if you took all the pages out of a book, mixed them up real good, and then tried to put all the pages back into the right order...and no, you can't use the page numbers printed on each page. Now imagine if it wasn't just one book, but hundreds of books, thousands of books with all their pages mixed together.

You can see that undeleting a file that resides in one cluster isn't hard unless there has been disk activity, and the cluster was recycled into another file, in which case you can't recover even the first cluster. Restoring anything past the first cluster requires knowledge of the pattern in which a drive writes clusters, to make a best guess where the next cluster (or part of the file) is. Several factors, including fragmentation on the drive, adversely affect the accuracy of the guess.

That being said, just because a file is unlikely to be fully re-assembled, doesn't mean you don't have to worry. The clusters can be accessed individually to show their contents. Binary data in a cluster isn't of much use, but if it's text, even a 2k cluster could contain a half page of typed data. a 64k cluster could contain thirteen typewritten pages. A lot of text information can be gathered by browsing a drive at the cluster level. That's why overwriting data is a good idea.

The reason the Recycle Bin was created is because undeleting can't be relied on.

[thecoalman]

I've used BCWipe before, http://www.jetico.com/ What's nice about this program is it adds a option on the right click to wipe the file intead of deleting. Adds the same option for right click on the recycle bin.

If you want to wipe a whole drive OS and all use this: http://dban.sourceforge.net/

[fLYtRap]

I've used BCWipe before, http://www.jetico.com/ What's nice about this program is it adds a option on the right click to wipe the file intead of deleting. Adds the same option for right click on the recycle bin.

If you want to wipe a whole drive OS and all use this: http://dban.sourceforge.net/

Thats what I notice on my trash can after installing eraser. I can now erase recycle bin which will overwrite the data at the same time.

On the other laptop am running washing process since yesterday and I still have 2 hours to go
Atter its done, doing so regulary will be much easier and quicker.

[fLYtRap]

Okay, I finished testing and here are results:

PC INSPECTOR FILE RECOVERY before errasing

[fLYtRap]

After errasing

[fLYtRap]

Screen shot from ROOT before errasing.

[fLYtRap]

After errasing

[fLYtRap]

And finally errasing report that shows lots of files that hasn't been errased (mostly windows protected files)

[fLYtRap]

Here is complete list of files that hasn't been errased

RIGHT CLICK ON THE ICON, OPEN PROPERITIES, COPY THE LINK AND PASTE IT TO YOUR BROWSER TO SEE THE TEXT