0

I was sanitising a USB drive and after wiping it I ran Recuva to check the results.

It finds a file called [000001].flv which is 113MB. The file starts with FLV and then the data looks random, certainly is not an FLV file.

So I delete the file and run Recuva, this time is finds a file called KPOPEAPFDRGPBOBD which is 120MB. Again the data looks random. I repeat the process and these file keep re-appearing with different names and slightly different sizes.

Anyone any idea as to what they are and whey they are getting created?

Mar
  • 3
  • 1
  • In general, file recovery software doesn't know the original filename - it's usually overwritten fairly quickly. Instead, it generates a suitable one based on what it can read of the file, although that may also be incomplete. – Matthew May 05 '17 at 14:39

1 Answers1

1

If you actually did wipe the entire USB with random data, it's possible some of the sectors on it contained data which looked like the start of a FLV or other file type. File carving (the technique I believe you are describing) works really well on some file types, while others will generate many many false positives. The names are random since it has no filesystem to tell it what the name should be.

user159726
  • 36
  • 3
  • Yes, I think is what is happening because I did some more tests and found some recovery software would create a file whenever they found FLV on the disk, of course the file was never valid. – Mar Jun 28 '17 at 12:30