Are File Names Obscured?

[login123]

After running CCleaner, are the original file names intact and find-able?

1.  Are they still intact for the files that were "CCleaned" while in the recycle bin?

2.  Are they still intact for files that were previously deleted from the recycle bin, say a month ago? 

3.  Are they still intact in the MFT?

4.  Are they still intact but "invisible" on the cleaned drive? 

 

These are the settiings I have checked: 

CCleaner > options > settings > secure file deletion (1 pass) > Wipe MFT Free Space

 

Thanks in advance. 

 

I have been to the documentation but might have missed something. I should already know the answer but don't.  If someone already knows it would save me the time required to do all that scanning. 

 

Started here:

http://www.piriform.com/docs/ccleaner/ccleaner-settings/changing-ccleaner-settings

 

sends me to here (Recuva docs):

http://www.piriform.com/docs/recuva/using-recuva/advanced-mode/securely-overwriting-your-files

 

sends me to here, (back to CCleaner docs) (where it doesn't actually give the answer):

http://www.piriform.com/docs/ccleaner/ccleaner-settings/changing-advanced-settings

 

also tried  here:

http://www.piriform.com/docs/ccleaner/advanced-usage/command-line-parameters

 

 

 

 

 

 

 

 

[Augeas]

As far as I can work out how CC works, with secure file deletion the live file is edited to overwrite the data to zeroes, the file name is changed to some variant of ZZZZ.ZZZ, and the file deleted, So the file name is overwritten and not findable.

 

The file name is held in Unicode format in its MFT record in the $File_Name attribute, which is of varying length. When the file name is changed to ZZZ.ZZZ the attribute length is altered to suit the new name. The $File_Name attribute has an id of 0x30, and is always followed by at least the $Data attribute (id 0x80), so any slack space in the $File_Name attribute is overwritten.

 

File names also exist in the directory record in the MFT. These are held in alphabetical sequence, so the directory entry will be reshuffled when the name is changed to ZZZ.ZZZ, and then on deletion reshuffled again if it's not the last file in the list and an end of file marker written on top of it.

 

So a secure file delete will get rid of the file names in the MFT, but I'm sure that NTFS has its own little ways of secreting them somewhere - transaction logs, page and hiber files etc,

[login123]

Thanks, Augeas for that excellent explanation. 

I just want to make them unavailable to an ordnary person. 

That should do it.