Photorec - erased files search after nwipe run
Posted: 16 Apr 2020, 19:36
I have some old hard disks to be scrapped. Because they contains confidential up to top secret data, I did run nwipe with the method DoD 5220.22-M. After that I checked, whether all the data have been erased.
Testdisk did not find any data.
Photorec did find a lot of files, but very strange: on the basis of both the file names and their date listed , they could not be on the erased hard disk, because they are created and/or modified long time after I put off the hard disk from PC. Rather it is possible, they could belong to another current active drive.
Is it regular, that Photorec runs in this way?
OS: openSUSE Leap 15.1
Nwipe, vers. 0.22
Testdisk, vers. 7.0
Photorec, vers. 7.0
Testdisk did not find any data.
Photorec did find a lot of files, but very strange: on the basis of both the file names and their date listed , they could not be on the erased hard disk, because they are created and/or modified long time after I put off the hard disk from PC. Rather it is possible, they could belong to another current active drive.
Is it regular, that Photorec runs in this way?
OS: openSUSE Leap 15.1
Nwipe, vers. 0.22
Testdisk, vers. 7.0
Photorec, vers. 7.0