Author Topic: Safe programs for File Recovery (Read 14,250 times)

kyrathaba · « **on:** January 26, 2011, 04:10 PM »

I'm working on a C# project involving file encryption/decryption. One of the features I've implemented is the option to "securely delete" the original file after it's been encrypted (such that only the encrypted version remains, and the original cannot be recovered by file recovery utilities). Now, I don't really want to post my code. What I'd like to know is if you guys can recommend some trustworthy/safe free file recovery utilities against which I can test my "secure deletion". Obviously, if any of those utilities can recover a file that my program has "securely deleted", then my code still needs work...

Here are a few I've Googled:

Disc Investigator
Recuva
Undelete Plus
Restoration
TestDisk
FILERECOVERY® 2011 for Windows
File Scavenger® - Data Recovery Utility
Data Recovery Wizard Free Edition

skwire · « **Reply #1 on:** January 26, 2011, 04:19 PM »

I have personally used File Scavenger in the past (with great results).

nosh · « **Reply #2 on:** January 26, 2011, 04:31 PM »

I can vouch for Recuva.

mouser · « **Reply #3 on:** January 26, 2011, 04:44 PM »

The one i always hear recommended is: http://www.runtime.org/

Stoic Joker · « **Reply #4 on:** January 26, 2011, 05:13 PM »

Quote from: mouser on January 26, 2011, 04:44 PM

The one i always hear recommended is: http://www.runtime.org/

That's my favorite!

JavaJones · « **Reply #5 on:** January 26, 2011, 06:41 PM »

R-Studio is pretty hardcore and should probably be on your list.

- Oshyan

Bamse · « **Reply #6 on:** January 26, 2011, 07:21 PM »

Was about to say R-Studio but will just add that demo only work with <64kb files. But you can get a forensic report to be used in a court, always useful.

JavaJones · « **Reply #7 on:** January 26, 2011, 07:23 PM »

The demo of R-Studio will at least show you the files it finds and thinks it can recover, even though you can only *verify* recovery of files smaller than 64kb.

- Oshyan

Bamse · « **Reply #8 on:** January 26, 2011, 07:42 PM »

Yes, wrong to say it only work with <64kb. I guess test must be so fool proof that there are zero signs of anything. If signs detected disk can be send off to some recovery genius and then who knows. Scanning is as paid version so that should do.

kyrathaba · « **Reply #9 on:** January 26, 2011, 08:10 PM »

So far, I've tested against:

(1) Pareto Data Recovery
(2) Softonic File Scavenger

PDR couldn't find the "securely deleted" text file 'unrecoverable22.txt' at all.

SFS found it, but it found the version my code had overwritten the original as, namely a zero-length file with file attributes showing creation/modified dates in year 2036, as shown below (in other words, what it found in no way resembles the original file). Rather it found the truncated, false-attributes file my code creates before calling File.Delete():

So, thus far, I'm pleased with how my code is holding up...

4wd · « **Reply #10 on:** January 27, 2011, 05:16 AM »

Just wondering, are you only relying on what 'files' the programs report they find or do you also look at the sectors where the file was located to see if any original file data remains?

kyrathaba · « **Reply #11 on:** January 27, 2011, 11:27 PM »

@4wd: I'm relying on the programs' reports. How do I look at the sectors?

4wd · « **Reply #12 on:** January 28, 2011, 12:05 AM »

If you could get your program to report the initial sectors occupied by the original file then you could look at them afterwards using a disk editor, eg. WinHex.

That's the only way I can think of barring a complete drive scan using Runtimes' software or R-Studio...but that will take a very long time unless you've set up a small seperate partition/drive to test on.

kyrathaba · « **Reply #13 on:** January 28, 2011, 12:15 AM »

What is the file doesn't get written to entirely contiguous areas on the hard drive?

patthecat · « **Reply #14 on:** January 28, 2011, 01:33 AM »

You should also randomize the filename as part of your utility.

Yeah WinHex will allow you to view sectors. It's been awhile since I've trained on WinHex / X-ways Forensic. Once you know the starting point of where the file exists on a hard drive, each file fragment will "point" to the beginning position of the next sequential fragment and so on. So if a file is non-contiguous, then the program would need to "traverse" to find all the fragments, like how the operating system does it. If it is securely deleted, overwritten multiple times, then there are problems in traversing and reading prior data content of file fragments.

4wd · « **Reply #15 on:** January 29, 2011, 02:56 PM »

As pat said, the various peices of the file will sequentially link to each other until the end of the file is reached.

If you can get your program to report the sectors read as it goes then you can have a look after erasing with a hex editor - HxD is good, lightweight and free.

FWIW, the program I use for 'shredding', overwrites any sector used by the original file with pseudo-random data, (full sector write, not just the part the file used), the ADS and changes the file name/size/timestamp/attributes multiple times.

kyrathaba · « **Reply #16 on:** January 29, 2011, 03:26 PM »

Thanks for the info, guys.

Mark0 · « **Reply #17 on:** February 08, 2011, 02:57 AM »

You can try also Back2Life: the evaluation mode is fully functional.

kyrathaba · « **Reply #18 on:** February 08, 2011, 02:22 PM »

@Mark0: thank you!

fenixproductions · « **Reply #19 on:** February 08, 2011, 02:27 PM »

Vote for Back2Life.