dslreports logo
 
    All Forums Hot Topics Gallery
spc
uniqs
36

spy1
Welcome to Amerika
Premium Member
join:2002-06-24
Charlotte, NC

1 edit

1 recommendation

spy1 to jansson_mark

Premium Member

to jansson_mark

Re: Hold on a second...lets clarify!

 
Seems to me that Eraser says quite specifically that it does erase the Master File Table records (see screenshot) - this from the Eraser "Help Topics":

"What Does It Do: When Erasing Unused Disk Space

But what is it that Eraser does to clear unused space on your disk? And where this unused space can be found?

If you have not disabled the option to erase cluster tip area (generally, there is no reason why you should disable this option unless the drive uses FAT file system and is compressed; see Overwriting Properly), Eraser will start by clearing this unused space from each file on the selected drive.

When a file is loaded in memory by some application or by the operating system (or opened without file sharing), its cluster tip area cannot be overwritten and you will receive an error because of this. To reduce the amount of locked files into a minimum, you should close as many applications as possible before erasing unused disk space and even then the files locked by the operating system cannot be accessed.

After taking care of the cluster tips, it is time to overwrite the free space on the drive. If your drive is equipped with a file system that supports quota and the space available to you is limited (i.e. the space available to you is smaller than the free space on the drive), you cannot erase unused space on that drive and should ask the administrator to do it instead.

To overwrite the free space, Eraser creates a temporary directory, which it fills with files (these are deleted after the erasing is finished). Multiple files are used because it is faster than creating one huge file. Data will be written until there is no more space available on the drive. This procedure may take a long time if the free area is large and it may slow down your computer substantially; especially if the paging file (swap) is located on the selected drive. This is another reason why you should close all applications before erasing unused space.

If you are running Windows NT or 2000 and the file system on the drive is NTFS, Eraser will next overwrite the free space on the Master File Table (MFT). The reason why this is done is that on NTFS file system, clusters are not necessarily allocated for files smaller than the size of a MFT record, but the file is stored completely in the MFT (the file is then said to be resident). If you have insecurely deleted such a small file, the free space on the MFT still may contain the file body and therefore, it must be erased as well. Windows 9x does not support NTFS file system so this step will be skipped.

Finally, the names of all previously deleted (or erased) files will be overwritten. On FAT{12,16,32} partitions this is done by going through all directory entries and overwriting deleted file entries. On NTFS partitions (Windows NT and 2000 only), Eraser creates maximum length files until the unused entries in the Master File Table are overwritten."

In addition to erasing unused disk space, you can also set the paging (swap) file to be overwritten on Windows NT and 2000. Using the General Preferences window you can enable this Windows NT security feature that overwrites all unused portions of the paging file when shutting down."

I've never found anything recoverable in the outputs of programs like Recuva, FileRecovery, Restoration, etc. BUT none of those programs is telling me in a clearly understandable manner whether the file namesof the files that've been deleted in the MFT have been over-written or not.

Eraser, Clean Disk Security, etc. ALL come up with a list of files that couldn't be erased due to having been locked by the operating system at the time of the run - are the previously deleted files' filenames there? Only God (and perhaps M$ ) knows.

That's my entire point - if we had a piece of software that would - IN PLAIN ENGLISH - produce ALL the file names to be found in any given computers' NTFS MFT, then we could simply run it, then go through our regular erasing routine (whatever that might be) and then run that software AGAIN to see if the NAMES of those files are still there in the MFT.

I really can't believe that this is SO hard to understand -OR that the reason it would be so useful is so hard to understand.

If nothing else, it would let everyone know (a) what file names ARE in any given MFT and (b) if someone's "erasing" program IS actually doing what it claims to be doing in relation to the MFT information.

In the meantime, I've spent more-than-enough time talking about this - NOR am I the ONLY one interested in such a piece of software, as indicated by several other peoples' posts.

I'm just going to kick back and see if anyone who can program such a piece of software is interested (hope springs eternal, etc., etc.). Later, guys. Pete

*Added screenshot of CDS doing its' thing on the MFT - bye now!
Sentinel
Premium Member
join:2001-02-07
Florida

1 edit

Sentinel

Premium Member

spy1,
If you don't mind ... what version of Eraser is that you are running in the above screen shots?

spy1
Welcome to Amerika
Premium Member
join:2002-06-24
Charlotte, NC

1 recommendation

spy1

Premium Member

It's Eraser v.5.84
Jrb2
Premium Member
join:2001-08-31

Jrb2

Premium Member

Hi Pete,

The latest version of Eraser is 5.86
See:
»[Free] Eraser Latest Version Eraser 5.86

(I don't have Eraser)

This surely is an interesting topic.
Although I don't have much time to participate in this thread, I have been asking myself whether some other tools (not yet mentioned here) might do the job.

- WinHex has already be mentioned. Will it do the job?

»www.winhex.com/cgi-bin/d ··· /12.html

»www.x-ways.net/winhex/al ··· res.html
quote:
Wiping unused space and slack space
...either to close security leaks, to securely destroy previously existing classified files that have been deleted in the traditional way only, or to minimize the size of your disk backups (like WinHex backups or Norton Ghost backups), since initialized space can be compressed 99%. On NTFS drives, WinHex will even offer to wipe all currently unused $Mft (Master File Table) file records, as they may still contain names and fragments of files previously stored in them. File slack can be found in the unused end of the last cluster allocated to a file, which usually contains traces of previously existing files. Slack space - like everything else - is processed by WinHex very fast. Also see X-Ways Security.

- Ace Utilities. Will it do the job?

»www.acelogix.com/aceutils.html

From the Helpfile :
quote:
Free space wipe settings

Free disk space and (MFT records)
As deletion is not secure enough, anyone can recover almost any file you have ever deleted. To ensure your files are deleted completely from your system, you should wipe the free space of your hard disk. Use this option to securely wipe the free space in your hard disk.

Cluster tip area
Selecting this option will erase the cluster tip areas of all the files, excluding the protected Windows system files.

Directory entries
The file system records the names and attributes of files to a special area called 'directory entries' for FAT and MFT for NTFS. When a file is deleted the corresponding directory entry is modified by the file system which makes it invisible to the Windows user. Unfortunately, most of the information would still exist and the name/attributes can be restored using 'any' recovery utility.

Checking this option will wipe off such entries from your Windows file system records.

- XPT / E3 from Radsoft. Will it do the job?

»www.radsoft.net/products ··· xpt.html

- TuneUp Utilities. Will it do the job?

»www.tune-up.com/

- FileVac / IEClean / NSClean. Will it do the job?

These programs are discontinued since Comodore acquired PSC.

spy1
Welcome to Amerika
Premium Member
join:2002-06-24
Charlotte, NC

1 edit

1 recommendation

spy1

Premium Member

Wow - Is this a can of worms, or what? lol! Jan, my friend, your post should provide me with absolutely HOURS of enjoyment.

Also found this from the link that OZO posted earlier - sounds bizarre enough to work - but how to CHECK? *I STILL need a program that I can understand to check before and AFTER the wipe! If you'll excuse me, I have to go out and howl at the moon now.

»www.myplanetsoft.com/fre ··· .php#mft Pete