Is Slackspace (unused part of the last clusters) are wiped as well with free space?

CCleaner for Windows CCleaner Windows Bug Reporting
1

As you know CCLeaner is able to wipe all the fee space on the hard disc.

Are only full free clusteres wiped?

As you may know there is more "free" space in the so called slackspace.

Assume a file foobar.exe allocates 95 clusters of 4096 bytes.

But the last 95th cluster is not completely needed but only 500 bytes out of it.

Then 4096-400=3596 bytes are unused free slackspace and may contain some

private data from the last allocated file.

Again: Does CCleaner wipe these slackspaces as well?

Well known Heidi Eraser tool does wipe such slackspace.

Thomas

2

I believe it does as of a recent version cleaning "cluster tips"

3

If a file has a size of 389620 bytes it uses (95 * 4096 ) + 500 bytes

and leaves a slack space of 3596 bytes to be wiped.

Those numbers are in doubt because I used Windows 7 Calculator to do the maths,

and I still remember when Windows 3.1 had arithmetic errors in CALC,

and Intel Pentium processor had separate errors in its hardware arithmetic

http://support.microsoft.com/kb/124345

It is to be hoped that XP, Vista, and Windows 7 do not mistakenly wipe 3596 bytes instead of 3595

and the whole file becomes useless due to a wiped E.O.F. character.

Some people might be disturbed by the thought that CCleaner could casually open and wipe the last 3596 bytes of a file.

Especially a vital file that has been write protected and hidden to protect from accidents :rolleyes:

Personally I am with Slartibartfast in the HitchHikers Guide to the Galaxy, who said

"It may disturb you. It scares the willies out of me."

http://www.imdb.com/...es?qt=qt0351050

EDITS 1 - 4

The above paragraph never appeared during preview of a subsequent reply.

I wrongly assumed that Slartibartfast was a semi-censored word that erased the paragraph in preview mode.

Now realised preview only shows the start of all posts.

4

As far as I can see with what passes for logic in my brain, Wipe Cluster Tips only applies to secure file deletion. I assume that previously CC would, when running secure file deletion, open the file, overwrite the content and then save it. Thus the remainder of the allocated space up to the next cluster boundary was not overwritten. Now that Wipe Cluster Tips is enabled I assume that the full allocated clusters for the file being securely deleted are overwritten.

Wipe Free Space allocates sufficient new files to fill the disk completely, then deletes them. The allocation of these files is in multiples of clusters, and the files would, or should, also be multiples of clusters so that everything is overwritten.

So from all this assumption, does WFS only overwrite free clusters? Yes. What does WCT apply to? Individual files being securely deleted. Does CC wipe cluster tips of live files? No.

5

As far as I can see with what passes for logic in my brain, Wipe Cluster Tips only applies to secure file deletion.

Many thanks, your logical answer has rescued my sanity.

For decades I was satisfied that I learnt all I needed to know when I used 8086 code in DOS 3.3? to format the tracks of a floppy disc.

I knew that special NON-rewritable identity blocks were each followed by a gap that allowed time for a Western Digital FD1771 to decide if the upcoming sector was what it wanted,

and upon getting what it wanted it then had time to switch into the appropriate mode to either read that data sector,

or instead to write a new data sector in which case it had to start erasing a few bytes of leading space because it could not avoid the possibility that the timing was a bit "off".

I understood that the same was true for my 20 MB HDD but I never risked trying to format that.

I chose to believe that NTFS was merely a "rip-off" from Unix of a Journalling System "overlay" that organised the use of data sectors but NOT how they were transferred to/from the media.

I accept that everything gets faster (and sometimes better) as technology advances,

but an improvement on the FD1771 technology that can preserve the first 500 bytes whilst over-writing the last 12 bytes of a 512 byte sector is an affront to my intellect.

It requires belief in a technology advance from several kilobytes per 200 mSec rotation of a floppy disc to much larger data tracks at much higher speeds on a modern HDD,

together with starting to write to the precise end of the 500th byte in a 512 byte sector,

instead of simply erasing a few bytes and then starting to write a new sector within a few dozen bytes of the previous location.

Incidentally, I seem to recall that groups of independent bits are NOT written as individual items on a track,

but those groups of bits become "encrypted" into patterns on the track,

and it would be more than ambitious to over-write the the last half of a pattern and hope that the first half of the group of bits can be preserved.

I guess the only way to deal with the cluster tip of a live file is to read the entire file and write back a new version that pads out the end of the file with zeroes fill the final cluster,

and that would "scare the willies out of me".

I wonder if, and how, Heidi can actually wipe the cluster tip of a live file.

I searched and found others were WANTING this capability in two results from

http://www.heidi.ie