dslreports logo
 
    All Forums Hot Topics Gallery
spc
uniqs
31
dave
Premium Member
join:2000-05-04
not in ohio

1 edit

dave to fatness

Premium Member

to fatness

Re: Removing names of deleted files from MFT

said by fatness:

Nice topic shift, from wanting to clean leftover MFT entries, to personal behavior.
I didn't bring up the subject of 'privacy' in this thread, I was merely responding to it. But the only reason for worrying about names in deleted MFT records is the desire to make them irretrievable by disk scavenging.
It's no more unusual or suspicious or wrong to want to clean old entries from the MFT than it is to clear your internet cache.
That's simply incorrect on a technical basis. Leftover files in the internet cache may conceivably have some impact on performance and/or correctness. The fact that the former name is still visible in a 'free' MFT entry has no effect in either of those dimensions. This is not a question of deleting unused garbage that takes up space; the space is taken up regardless of whether the old name is visible or it isn't.

In short, if you want to do this, I think either you must be worried about 3rd-party recovery of the names, or you must be wrongly informed about the operation of the file system.

BTW, in order to even see this stuff, you need to access the disk below the level of the file system.
Sentinel
Premium Member
join:2001-02-07
Florida

Sentinel

Premium Member

said by dave:

said by fatness:

Nice topic shift, from wanting to clean leftover MFT entries, to personal behavior.
I didn't bring up the subject of 'privacy' in this thread, I was merely responding to it. But the only reason for worrying about names in deleted MFT records is the desire to make them irretrievable by disk scavenging.
It's no more unusual or suspicious or wrong to want to clean old entries from the MFT than it is to clear your internet cache.
That's simply incorrect on a technical basis. Leftover files in the internet cache may conceivably have some impact on performance and/or correctness. The fact that the former name is still visible in a 'free' MFT entry has no effect in either of those dimensions. This is not a question of deleting unused garbage that takes up space; the space is taken up regardless of whether the old name is visible or it isn't.

In short, if you want to do this, I think either you must be worried about 3rd-party recovery of the names, or you must be wrongly informed about the operation of the file system.

BTW, in order to even see this stuff, you need to access the disk below the level of the file system.
dave,
Thanks for that answer.
Also with regards to fatness' comments ... far be it from me to speak for fatness but ... what I think he meant had nothing to do wiht performance but I think he was just saying that from a security perspective it is no different for someone to want to get rid of this stuff than any other stuff.

fatness
subtle

join:2000-11-17
fishing

2 recommendations

fatness

said by Sentinel:

Also with regards to fatness' comments ... far be it from me to speak for fatness but ... what I think he meant had nothing to do wiht performance but I think he was just saying that from a security perspective it is no different for someone to want to get rid of this stuff than any other stuff.
Yes, that's correct. I don't think degree of technical difficulty sheds any light on the motives of the person wanting to perform the task.

It's easy to clear your Temporary Internet Files. Many people do it.
It's a bit harder to see and clear index.dat files. Yet some people do it.
It's harder yet to clear old file names from MFT records. Some people want to do it.

To me, the argument that "it's difficult to access, so your motives are suspect" makes as much sense as impugning the motives of someone asking for advice replacing the hardest part to reach in an automobile engine. Nobody bought that OS with the idea that part of it was owned by police investigators and divorce lawyers, and off-limits to the person who bought the OS.
dave
Premium Member
join:2000-05-04
not in ohio

1 edit

dave

Premium Member

said by fatness:

Yes, that's correct. I don't think degree of technical difficulty sheds any light on the motives of the person wanting to perform the task.
The only point where I correlated 'difficulty' and 'motive' was in a sentence like 'it's hard for me to see why you want to do this'.

--

This to me has the flavour of one of those interminable questions that show up in the Microsoft help forum, from people who anxiously run all sorts of "maintenance" programs that are entirely unnecessary; the "defrag every day" crowd. I'd ask someone there why they felt it was necessary to do this stuff, and I'm asking someone here why they feel it is necessary to erase the names from MFT entries.