In windows the file name is actually seperate from the actual data of the file. The file takes up a space on the hard drive and the name of that file is really just a record in the master fat table (MFT).
For instance, if you make a text file in notepad and name it A.txt and save one characture inside it like 1, if you view the properties of the text file you will see that it's size is 1byte. (1 characture is one byte)
Now if you reame that file to abcdefghijklmnopqrstuvwxyz.txt you will see that the file size is still only 1byte.
That shows you that the filename is seperate from the file, otherwise the size of the file would have increased by 25bytes.
So that shows you for any file, it is really 2 parts. The actual file is the data and the name is a record in the MFT.
When you overwrite a file, it overwrites the data part on the hard drive and makes the contents of the file unrecoverable.
But the record is still in the MFT so the name of the file may be visible but the data of the file is unrecoverable.
Usually this isn't a concern unless the name of the file gives away what you may or may not have had on the system at one time.
In order to remove the file name, the record in the MFT has to be "scrambled". Because of windows limitations and the fact that this table holds all the records for every file name on the system, it can't be overwritten or erased, all that can be done is "scramble" the record. When that is done you may or may not still see "gibberish" names in the recovery wizzard.
You may notice random names in the recovery wizzard but the actual files are unrecoverable.
If you see file names that are still "Green" and recoverable, it's usually due to the location of the files.
Windows is unable to lock certain folders in use. The only way I have gotten around that is by trying to wipe the free space right after a reboot (before opening any programs), or by thoroughly defragmenting the drive to move the physical location of those folders and then wiping the free space of the former location.
It's actually very difficult to wipe data off a system, thats why it is so easy for people to recover sensitive data from one.
The only true and reliable way to do it is from "outside" of windows when nothing is in use and when you can use something that does not have to "respect" windows folder and user permissions.
It's not an easy task but it's nice to have the recovery wizzard to give you an idea on what is still there.
Dave
