I tried to do a secure erase on all the files recuva found, just to try it out, and a lot of files errored out because the file is resident in the mft.
Could someone explain this to me, and tell me how a file gets out of the mft, whether automatically or forced out? I thought the MFT only contained info regarding each file, it didn't actually have any files in it, so I'm confused by this.
If a file is small enough, say 6-700 bytes, then it can fit entirely into its 1024-byte MFT record. Recuva will not overwrite data in the MFT so it cannot securely delete these files. You could try wiping the MFT with CC, or not bother about it.
If a file is small enough, say 6-700 bytes, then it can fit entirely into its 1024-byte MFT record. Recuva will not overwrite data in the MFT so it cannot securely delete these files. You could try wiping the MFT with CC, or not bother about it.
Thanks for explaining. I still dont understand why if the file is deleted, it would stay in the MFT though. Shouldn't a normal delete remove it from there as well, or mark it for deletion upon some process or something happening?
A normal delete will simply flag the file as deleted, as it does for a file that has data outside of the MFT. The file can be securely deleted using CC, or try the wipe MFT option in CC.