Welcome Guest.   Make a donation to an author on the site October 25, 2014, 08:54:26 PM  *

Please login or register.
Or did you miss your validation email?


Login with username and password (forgot your password?)
Why not become a lifetime supporting member of the site with a one-time donation of any amount? Your donation entitles you to a ton of additional benefits, including access to exclusive discounts and downloads, the ability to enter monthly free software drawings, and a single non-expiring license key for all of our programs.


You must sign up here before you can post and access some areas of the site. Registration is totally free and confidential.
 
Learn about the DonationCoder.com microdonation system (DonationCredits).
   
   Forum Home   Thread Marks Chat! Downloads Search Login Register  
Pages: [1]   Go Down
  Reply  |  New Topic  |  Print  
Author Topic: Safe programs for File Recovery  (Read 3714 times)
kyrathaba
N.A.N.Y. Organizer
Honorary Member
**
Posts: 3,010



while(! dead_horse){beat}

see users location on a map View Profile WWW Read user's biography. Give some DonationCredits to this forum member
« on: January 26, 2011, 10:10:15 AM »

I'm working on a C# project involving file encryption/decryption.  One of the features I've implemented is the option to "securely delete" the original file after it's been encrypted (such that only the encrypted version remains, and the original cannot be recovered by file recovery utilities).  Now, I don't really want to post my code.  What I'd like to know is if you guys can recommend some trustworthy/safe free file recovery utilities against which I can test my "secure deletion".  Obviously, if any of those utilities can recover a file that my program has "securely deleted", then my code still needs work...

Here are a few I've Googled:

Disc Investigator
Recuva
Undelete Plus
Restoration
TestDisk
FILERECOVERY® 2011 for Windows
File Scavenger® - Data Recovery Utility
Data Recovery Wizard Free Edition
Logged

Win 7 Home Premium 64bit-SP1 AMD Athlon II X2 220 Socket AM3 (938) @ 2.1GHz 6GB RAM Firefox 26.0
_________________________________________________________________________________________

I'm fighting against patent trolls. Join me and tell your representative to support the #SHIELDAct: https://eff.org/r.b6JJ /via @EFF

My DC page: http://kyrathaba.dcmembers.com | My blog: http://williambryanmiller.com/ | Proofreading Service: http://bit.ly/1fQSqQP

skwire
Global Moderator
*****
Posts: 4,118



Another Coding Snack request? Om nom nom...

see users location on a map View Profile WWW Give some DonationCredits to this forum member
« Reply #1 on: January 26, 2011, 10:19:46 AM »

I have personally used File Scavenger in the past (with great results).
Logged

nosh
Supporting Member
**
Posts: 1,388


View Profile Give some DonationCredits to this forum member
« Reply #2 on: January 26, 2011, 10:31:43 AM »

I can vouch for Recuva.
Logged
mouser
First Author
Administrator
*****
Posts: 33,598



see users location on a map View Profile WWW Read user's biography. Give some DonationCredits to this forum member
« Reply #3 on: January 26, 2011, 10:44:09 AM »

The one i always hear recommended is: http://www.runtime.org/
Logged
Stoic Joker
Honorary Member
**
Posts: 5,334



View Profile WWW Give some DonationCredits to this forum member
« Reply #4 on: January 26, 2011, 11:13:38 AM »

The one i always hear recommended is: http://www.runtime.org/

That's my favorite!
Logged
JavaJones
Review 2.0 Designer
Charter Member
***
Posts: 2,537



see users location on a map View Profile WWW Read user's biography. Give some DonationCredits to this forum member
« Reply #5 on: January 26, 2011, 12:41:07 PM »

R-Studio is pretty hardcore and should probably be on your list.

- Oshyan
Logged

The New Adventures of Oshyan Greene - A life in pictures...
Bamse
Supporting Member
**
Posts: 410


View Profile Give some DonationCredits to this forum member
« Reply #6 on: January 26, 2011, 01:21:08 PM »

Was about to say R-Studio but will just add that demo only work with <64kb files. But you can get a forensic report to be used in a court, always useful.
Logged
JavaJones
Review 2.0 Designer
Charter Member
***
Posts: 2,537



see users location on a map View Profile WWW Read user's biography. Give some DonationCredits to this forum member
« Reply #7 on: January 26, 2011, 01:23:30 PM »

The demo of R-Studio will at least show you the files it finds and thinks it can recover, even though you can only *verify* recovery of files smaller than 64kb.

- Oshyan
Logged

The New Adventures of Oshyan Greene - A life in pictures...
Bamse
Supporting Member
**
Posts: 410


View Profile Give some DonationCredits to this forum member
« Reply #8 on: January 26, 2011, 01:42:48 PM »

Yes, wrong to say it only work with <64kb. I guess test must be so fool proof that there are zero signs of anything. If signs detected disk can be send off to some recovery genius and then who knows. Scanning is as paid version so that should do.
Logged
kyrathaba
N.A.N.Y. Organizer
Honorary Member
**
Posts: 3,010



while(! dead_horse){beat}

see users location on a map View Profile WWW Read user's biography. Give some DonationCredits to this forum member
« Reply #9 on: January 26, 2011, 02:10:44 PM »

So far, I've tested against:

(1) Pareto Data Recovery
(2) Softonic File Scavenger

PDR couldn't find the "securely deleted" text file 'unrecoverable22.txt' at all.

SFS found it, but it found the version my code had overwritten the original as, namely a zero-length file with file attributes showing creation/modified dates in year 2036, as shown below (in other words, what it found in no way resembles the original file).  Rather it found the truncated, false-attributes file my code creates before calling File.Delete():



So, thus far, I'm pleased with how my code is holding up...

Logged

Win 7 Home Premium 64bit-SP1 AMD Athlon II X2 220 Socket AM3 (938) @ 2.1GHz 6GB RAM Firefox 26.0
_________________________________________________________________________________________

I'm fighting against patent trolls. Join me and tell your representative to support the #SHIELDAct: https://eff.org/r.b6JJ /via @EFF

My DC page: http://kyrathaba.dcmembers.com | My blog: http://williambryanmiller.com/ | Proofreading Service: http://bit.ly/1fQSqQP

4wd
Supporting Member
**
Posts: 3,355



see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #10 on: January 26, 2011, 11:16:13 PM »

Just wondering, are you only relying on what 'files' the programs report they find or do you also look at the sectors where the file was located to see if any original file data remains?
Logged

I do not need to control my anger ... people just need to stop pissing me off!
kyrathaba
N.A.N.Y. Organizer
Honorary Member
**
Posts: 3,010



while(! dead_horse){beat}

see users location on a map View Profile WWW Read user's biography. Give some DonationCredits to this forum member
« Reply #11 on: January 27, 2011, 05:27:52 PM »

@4wd:  I'm relying on the programs' reports.  How do I look at the sectors? 
Logged

Win 7 Home Premium 64bit-SP1 AMD Athlon II X2 220 Socket AM3 (938) @ 2.1GHz 6GB RAM Firefox 26.0
_________________________________________________________________________________________

I'm fighting against patent trolls. Join me and tell your representative to support the #SHIELDAct: https://eff.org/r.b6JJ /via @EFF

My DC page: http://kyrathaba.dcmembers.com | My blog: http://williambryanmiller.com/ | Proofreading Service: http://bit.ly/1fQSqQP

4wd
Supporting Member
**
Posts: 3,355



see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #12 on: January 27, 2011, 06:05:54 PM »

If you could get your program to report the initial sectors occupied by the original file then you could look at them afterwards using a disk editor, eg. WinHex.

That's the only way I can think of barring a complete drive scan using Runtimes' software or R-Studio...but that will take a very long time unless you've set up a small seperate partition/drive to test on.
Logged

I do not need to control my anger ... people just need to stop pissing me off!
kyrathaba
N.A.N.Y. Organizer
Honorary Member
**
Posts: 3,010



while(! dead_horse){beat}

see users location on a map View Profile WWW Read user's biography. Give some DonationCredits to this forum member
« Reply #13 on: January 27, 2011, 06:15:47 PM »

What is the file doesn't get written to entirely contiguous areas on the hard drive? 
Logged

Win 7 Home Premium 64bit-SP1 AMD Athlon II X2 220 Socket AM3 (938) @ 2.1GHz 6GB RAM Firefox 26.0
_________________________________________________________________________________________

I'm fighting against patent trolls. Join me and tell your representative to support the #SHIELDAct: https://eff.org/r.b6JJ /via @EFF

My DC page: http://kyrathaba.dcmembers.com | My blog: http://williambryanmiller.com/ | Proofreading Service: http://bit.ly/1fQSqQP

patthecat
Member
**
Posts: 88


View Profile Give some DonationCredits to this forum member
« Reply #14 on: January 27, 2011, 07:33:51 PM »

You should also randomize the filename as part of your utility.

Yeah WinHex will allow you to view sectors.  It's been awhile since I've trained on WinHex / X-ways Forensic.  Once you know the starting point of where the file exists on a hard drive, each file fragment will "point" to the beginning position of the next sequential fragment and so on.  So if a file is non-contiguous, then the program would need to "traverse" to find all the fragments, like how the operating system does it.  If it is securely deleted, overwritten multiple times, then there are problems in traversing and reading prior data content of file fragments.
Logged
4wd
Supporting Member
**
Posts: 3,355



see users location on a map View Profile Read user's biography. Give some DonationCredits to this forum member
« Reply #15 on: January 29, 2011, 08:56:39 AM »

As pat said, the various peices of the file will sequentially link to each other until the end of the file is reached.

If you can get your program to report the sectors read as it goes then you can have a look after erasing with a hex editor - HxD is good, lightweight and free.

FWIW, the program I use for 'shredding', overwrites any sector used by the original file with pseudo-random data, (full sector write, not just the part the file used), the ADS and changes the file name/size/timestamp/attributes multiple times.
Logged

I do not need to control my anger ... people just need to stop pissing me off!
kyrathaba
N.A.N.Y. Organizer
Honorary Member
**
Posts: 3,010



while(! dead_horse){beat}

see users location on a map View Profile WWW Read user's biography. Give some DonationCredits to this forum member
« Reply #16 on: January 29, 2011, 09:26:21 AM »

Thanks for the info, guys.
Logged

Win 7 Home Premium 64bit-SP1 AMD Athlon II X2 220 Socket AM3 (938) @ 2.1GHz 6GB RAM Firefox 26.0
_________________________________________________________________________________________

I'm fighting against patent trolls. Join me and tell your representative to support the #SHIELDAct: https://eff.org/r.b6JJ /via @EFF

My DC page: http://kyrathaba.dcmembers.com | My blog: http://williambryanmiller.com/ | Proofreading Service: http://bit.ly/1fQSqQP

Mark0
Charter Honorary Member
***
Posts: 593


see users location on a map View Profile WWW Give some DonationCredits to this forum member
« Reply #17 on: February 07, 2011, 08:57:59 PM »

You can try also Back2Life: the evaluation mode is fully functional.
Logged

kyrathaba
N.A.N.Y. Organizer
Honorary Member
**
Posts: 3,010



while(! dead_horse){beat}

see users location on a map View Profile WWW Read user's biography. Give some DonationCredits to this forum member
« Reply #18 on: February 08, 2011, 08:22:38 AM »

@Mark0: thank you!
Logged

Win 7 Home Premium 64bit-SP1 AMD Athlon II X2 220 Socket AM3 (938) @ 2.1GHz 6GB RAM Firefox 26.0
_________________________________________________________________________________________

I'm fighting against patent trolls. Join me and tell your representative to support the #SHIELDAct: https://eff.org/r.b6JJ /via @EFF

My DC page: http://kyrathaba.dcmembers.com | My blog: http://williambryanmiller.com/ | Proofreading Service: http://bit.ly/1fQSqQP

fenixproductions
Honorary Member
**
Posts: 1,170



see users location on a map View Profile WWW Give some DonationCredits to this forum member
« Reply #19 on: February 08, 2011, 08:27:57 AM »

Vote for Back2Life.
Logged

Надо было учиться, а не камни в школу бросать...
--
When I am bored I write for displaynone smiley
--
f0dder is my personal hero smiley
Pages: [1]   Go Up
  Reply  |  New Topic  |  Print  
 
Jump to:  
   Forum Home   Thread Marks Chat! Downloads Search Login Register  

DonationCoder.com | About Us
DonationCoder.com Forum | Powered by SMF
[ Page time: 0.045s | Server load: 0.27 ]