topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • Thursday March 28, 2024, 12:57 pm
  • Proudly celebrating 15+ years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: Safe programs for File Recovery  (Read 9593 times)

kyrathaba

  • N.A.N.Y. Organizer
  • Honorary Member
  • Joined in 2006
  • **
  • Posts: 3,200
    • View Profile
    • Donate to Member
Safe programs for File Recovery
« on: January 26, 2011, 10:10 AM »
I'm working on a C# project involving file encryption/decryption.  One of the features I've implemented is the option to "securely delete" the original file after it's been encrypted (such that only the encrypted version remains, and the original cannot be recovered by file recovery utilities).  Now, I don't really want to post my code.  What I'd like to know is if you guys can recommend some trustworthy/safe free file recovery utilities against which I can test my "secure deletion".  Obviously, if any of those utilities can recover a file that my program has "securely deleted", then my code still needs work...

Here are a few I've Googled:

Disc Investigator
Recuva
Undelete Plus
Restoration
TestDisk
FILERECOVERY® 2011 for Windows
File Scavenger® - Data Recovery Utility
Data Recovery Wizard Free Edition

skwire

  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 5,286
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #1 on: January 26, 2011, 10:19 AM »
I have personally used File Scavenger in the past (with great results).

nosh

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,441
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #2 on: January 26, 2011, 10:31 AM »
I can vouch for Recuva.

mouser

  • First Author
  • Administrator
  • Joined in 2005
  • *****
  • Posts: 40,896
    • View Profile
    • Mouser's Software Zone on DonationCoder.com
    • Read more about this member.
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #3 on: January 26, 2011, 10:44 AM »
The one i always hear recommended is: http://www.runtime.org/

Stoic Joker

  • Honorary Member
  • Joined in 2008
  • **
  • Posts: 6,646
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #4 on: January 26, 2011, 11:13 AM »
The one i always hear recommended is: http://www.runtime.org/

That's my favorite!

JavaJones

  • Review 2.0 Designer
  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 2,739
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #5 on: January 26, 2011, 12:41 PM »
R-Studio is pretty hardcore and should probably be on your list.

- Oshyan

Bamse

  • Supporting Member
  • Joined in 2009
  • **
  • Posts: 410
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #6 on: January 26, 2011, 01:21 PM »
Was about to say R-Studio but will just add that demo only work with <64kb files. But you can get a forensic report to be used in a court, always useful.

JavaJones

  • Review 2.0 Designer
  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 2,739
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #7 on: January 26, 2011, 01:23 PM »
The demo of R-Studio will at least show you the files it finds and thinks it can recover, even though you can only *verify* recovery of files smaller than 64kb.

- Oshyan

Bamse

  • Supporting Member
  • Joined in 2009
  • **
  • Posts: 410
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #8 on: January 26, 2011, 01:42 PM »
Yes, wrong to say it only work with <64kb. I guess test must be so fool proof that there are zero signs of anything. If signs detected disk can be send off to some recovery genius and then who knows. Scanning is as paid version so that should do.

kyrathaba

  • N.A.N.Y. Organizer
  • Honorary Member
  • Joined in 2006
  • **
  • Posts: 3,200
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #9 on: January 26, 2011, 02:10 PM »
So far, I've tested against:

(1) Pareto Data Recovery
(2) Softonic File Scavenger

PDR couldn't find the "securely deleted" text file 'unrecoverable22.txt' at all.

SFS found it, but it found the version my code had overwritten the original as, namely a zero-length file with file attributes showing creation/modified dates in year 2036, as shown below (in other words, what it found in no way resembles the original file).  Rather it found the truncated, false-attributes file my code creates before calling File.Delete():

http://i91.photobucket.com/albums/k311/kyrathaba/Screen%20Captures/scavenger.png
Safe programs for File Recovery


So, thus far, I'm pleased with how my code is holding up...


4wd

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 5,641
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #10 on: January 26, 2011, 11:16 PM »
Just wondering, are you only relying on what 'files' the programs report they find or do you also look at the sectors where the file was located to see if any original file data remains?

kyrathaba

  • N.A.N.Y. Organizer
  • Honorary Member
  • Joined in 2006
  • **
  • Posts: 3,200
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #11 on: January 27, 2011, 05:27 PM »
@4wd:  I'm relying on the programs' reports.  How do I look at the sectors? 

4wd

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 5,641
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #12 on: January 27, 2011, 06:05 PM »
If you could get your program to report the initial sectors occupied by the original file then you could look at them afterwards using a disk editor, eg. WinHex.

That's the only way I can think of barring a complete drive scan using Runtimes' software or R-Studio...but that will take a very long time unless you've set up a small seperate partition/drive to test on.

kyrathaba

  • N.A.N.Y. Organizer
  • Honorary Member
  • Joined in 2006
  • **
  • Posts: 3,200
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #13 on: January 27, 2011, 06:15 PM »
What is the file doesn't get written to entirely contiguous areas on the hard drive? 

patthecat

  • Member
  • Joined in 2006
  • **
  • Posts: 88
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #14 on: January 27, 2011, 07:33 PM »
You should also randomize the filename as part of your utility.

Yeah WinHex will allow you to view sectors.  It's been awhile since I've trained on WinHex / X-ways Forensic.  Once you know the starting point of where the file exists on a hard drive, each file fragment will "point" to the beginning position of the next sequential fragment and so on.  So if a file is non-contiguous, then the program would need to "traverse" to find all the fragments, like how the operating system does it.  If it is securely deleted, overwritten multiple times, then there are problems in traversing and reading prior data content of file fragments.

4wd

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 5,641
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #15 on: January 29, 2011, 08:56 AM »
As pat said, the various peices of the file will sequentially link to each other until the end of the file is reached.

If you can get your program to report the sectors read as it goes then you can have a look after erasing with a hex editor - HxD is good, lightweight and free.

FWIW, the program I use for 'shredding', overwrites any sector used by the original file with pseudo-random data, (full sector write, not just the part the file used), the ADS and changes the file name/size/timestamp/attributes multiple times.

kyrathaba

  • N.A.N.Y. Organizer
  • Honorary Member
  • Joined in 2006
  • **
  • Posts: 3,200
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #16 on: January 29, 2011, 09:26 AM »
Thanks for the info, guys.

Mark0

  • Charter Honorary Member
  • Joined in 2005
  • ***
  • Posts: 652
    • View Profile
    • Mark's home
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #17 on: February 07, 2011, 08:57 PM »
You can try also Back2Life: the evaluation mode is fully functional.

kyrathaba

  • N.A.N.Y. Organizer
  • Honorary Member
  • Joined in 2006
  • **
  • Posts: 3,200
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #18 on: February 08, 2011, 08:22 AM »
@Mark0: thank you!

fenixproductions

  • Honorary Member
  • Joined in 2006
  • **
  • Posts: 1,186
    • View Profile
    • Donate to Member
Re: Safe programs for File Recovery
« Reply #19 on: February 08, 2011, 08:27 AM »
Vote for Back2Life.