I'd been trying to sanitize the free space on my C drive with limited success (without wanting to lose any of my data.) But every time I'd run Recuva it would see loads of files that I thought should have been purged from the system.
The tool I was using to clean the empty space on my C drive was SDelete from Sysinternals (syntax for one cleaning cycle: sdelete.exe -c C:). I think it is a good tool but even after 7 cycles, I was seeing deleted files appear in Recuva. The files Recuva said were recoverable were actually not, since I recovered ~3500 files using Recuva and all were corrupt. Still, it was annoying Recuva could still see the file names and folder paths.
Going forward, I plan to use Alternate File Shredder to properly delete stuff, but for now I wanted to fill my C drive with garbage and see if Recuva can still see the old file names and folder paths (alas, it still did, but the exercise was useful anyway.)
We use PowerShell command line.
1) Make a folder called garbage on the C drive:
cd c:\
mkdir garbage
cd garbage
2) Set your drive letter. And take a look at the sizeRemaining (free space) on the drive:
$Drive = "C"
$volInfo = Get-Volume $Drive
$volInfo.sizeRemaining
3) Set a size for the garbage files (this is an INT32, the limit being just under 2GB):
$size = 1GB
4) Create a garbage file full of random data of size $size:
$count = 1
$path = Join-Path $pwd ("garbage"+[String]$count+".txt")
$content = New-Object byte[] $size
(New-Object System.Random).NextBytes($content)
[System.IO.File]::WriteAllBytes($path, $content)
$count++
5) Once happy it works, run the above code inside a while loop. It will fill up the hard drive leaving free space of $size x 1.5.
while((Get-Volume $Drive).sizeRemaining - ($size * 1.5) -ge 0){
$path
$path = Join-Path $pwd ("garbage"+[String]$count+".txt")
$content = New-Object byte[] $size
(New-Object System.Random).NextBytes($content)
[System.IO.File]::WriteAllBytes($path, $content)
$count++
}
Epilogue
I finally found a tool that got rid of those pesky deleted file names and file paths that Recuva kept on seeing - PrivaZer. Privazer is a very thorough tool. It cleans the "Free MFT entries" and "USN entries" and free sectors, and so much more.
Recuva went from seeing nearly 40'000 ghost files, to less than 1500. Fantastic! Well done PrivaZer! Even a Recuva deep scan showed less that 1500 files.
Comments
Post a Comment