Wipe MFT only.

Hi guys,

Congratulations on the option to wipe MFT. I'm delighted with the results. I would like a menu option to go directly to wiping MFT, rather than having to wait for a full free disk space wipe. Any suggestions?

Cheers, Meadows.

Hi guys,

Congratulations on the option to wipe MFT. I'm delighted with the results. I would like a menu option to go directly to wiping MFT, rather than having wait for a full free disk space wipe. Any suggestions?

Cheers, Meadows.

I can now answer my own question! My latest update (v2.29.1111) does the MFT wipe before the disk free space wipe. Very useful.

Cheers, Meadows.

What's the advantage of overwriting the MFT before overwriting free space?

What's the advantage of overwriting the MFT before overwriting free space?

... and (from the topic title) what's the point of only overwriting MFT freespace?

What's the advantage of wiping free space and/or MFT? :)

I can see that some users would wish to overwrite free space and entries in the MFT from time to time, to ensure some perceived level of security. I just can't see why the order - MFT first or last - is important. But as Piriform changed the order, from MFT last to first, there must be some reason that I don't get.

Having the ability to overwrite the MFT without overwriting free space shows that the process is not the same as that used by popular space overwriters, i.e. fill all the available free space so that the MFT can't expand, then create zero length files until the disk, and the MFT, is filled, then delete the lot. Without filling free space this method of clearing the MFT isn't available. I wonder if CC does a count of the total/used entries in the MFT, takes one from t'other, creates sufficient zero length files to fill the unused entries, then deletes them?

Later edit: I thought that overwriting the MFT could be run independently, but from looking at the docs I'm not sure. Is it only valid if you have the overwrite free space option ticked as well? I guess it must be, as otherwise CC wouldn't know which drive to run Wipe MFT on.

Later edit: I thought that overwriting the MFT could be run independently, but from looking at the docs I'm not sure.

I don't know how the MFT funtions in detail but that would make sense to me. If you're doing this from a security point of view there's no sense in cleaning the MFT but not the data. Assuming, of course, there's no other system operational or performance benefit to doing so.

I suppose, theoretically one could run the WFS option, then cancel the action as soon as the MFT wipe was over.

No, wait, that's a terrible idea. My vote goes toward these two being separate options for a future release. :)

No, wait, that's a terrible idea. My vote goes toward these two being separate options for a future release. :)

But to reiterate, I'm still looking for a reason why you would want to delete MFT freespace but not disk freespace. What is the benefit?!

But to reiterate, I'm still looking for a reason why you would want to delete MFT freespace but not disk freespace. What is the benefit?!

The amount of MFT freespace would usually be much less than the amount of disk freespace - so I am guessing it would be faster to delete MFT freespace than to delete all disk freespace.

Everyone is in a hurry these days. ;)

The amount of MFT freespace would usually be much less than the amount of disk freespace - so I am guessing it would be faster to delete MFT freespace than to delete all disk freespace.

Yep, but the only reason I'm aware of to delete MFT freespace is a security measure to erase MFT file metadata. Since the files themselves are still potentially in the unerased freespace, what's the gain? Surely the files themselves are the priority and MFT is just that bit extra. Erasing the latter without the former doesn't seem to achieve much.

What's the advantage of overwriting the MFT before overwriting free space?

Hi Guys. I notice that no-one sees any advantage in wiping MFT without doing a full disk wipe.

Let me explain: I have a fast way to clean the disk.

Lets assume we can start with a clean MFT and a clean disk. After use, especially online, we are going to have a number of deleted temp and other files which are recoverable. To overwrite them I go into RECUVA, scan for files, check all files in the "recoverable" list and select the option "Overwrite checked" . Disk free space is totally overwritten again (I know, maybe not totally...) Done in seconds instead of an hour or more :D required to overwrite disk free space in CCleaner. What I have is an incremental operation instead of a complete re-run.

The only problem remaining is that Recuva can't overwrite in the MFT. Message "not overwritten...file is resident in MFT". So first I "wipe" MFT in CCleaner, then overwrite recoverable files in Recuva. Three minutes.

Cheers, Meadows

P.S. FearNothingProductions, I do run WFS and then stop it when MFT is finished. It is probably a "terrible idea" but seems to work for the mean time. Do you see any real dangers?

Best idea is definitely separate options in a future release. Piriform? :rolleyes:

Hi Meadows, I was curious to know what advantage there was in overwriting the MFT before overwriting free space, as opposed to overwriting free space first and then the MFT.

This thread http://forum.piriform.com/index.php?showtopic=27221&hl= indicates that it is not possible to overwrite the MFT without overwriting free space. So how are you overwriting the MFT on its own? When you overwrite the MFT what indication is there that this has indeed been done?

P.S. Just seen your PS. That explains how you do it (but 20 days after the thread started!). I can't see any great danger. What happens to the deleted file names in the MFT after running Wipe MFT this way?

Hi Meadows, I was curious to know what advantage there was in overwriting the MFT before overwriting free space, as opposed to overwriting free space first and then the MFT.

This thread http://forum.piriform.com/index.php?showtopic=27221&hl= indicates that it is not possible to overwrite the MFT without overwriting free space. So how are you overwriting the MFT on its own? When you overwrite the MFT what indication is there that this has indeed been done?

P.S. Just seen your PS. That explains how you do it. I can't see any great danger. What happens to the deleted file names in the MFT after running Wipe MFT this way?

Hi Augeas, the indication that it has been done is also in Recuva. After MFT wipe in CC go to Recuva and scan for recoverable files. The MFT is full of recoverable files of 600 zero bytes in the incremental zz...........zz format. The way CCleaner "wipes" the MFT is to create enough of these files to fill all the free space in the MFT and then delete them, thereby (I suppose) completely deleting or overwriting all the old filenames.

Cheers, Meadows

P.S. Just seen your PS. That explains how you do it (but 20 days after the thread started!). I can't see any great danger. What happens to the deleted file names in the MFT after running Wipe MFT this way?

Oops, sorry about the 20 days - holiday in the sun. B)

I guess the only danger is that chopping the WFS option might leave one or more of the filler files that CC uses to overwrite free space in the root directory. Perhaps CC clears them up if you press Cancel, as opposed to a brute chop.

Sure. Use the cancel button - that should clean up before exit.

What's the advantage of wiping free space and/or MFT? :)

Wipe MFT will wipe the unused MFT entries that point to old, deleted files on an NTFS drive.

Wipe free space wipe the actual space on the hard disk that these files occupied. (And that are still there since deletion does not remove the data.)

Separate note, for the person who asked why does it matter whether you do MFT then free space, or vice versa; my response is that if I personally had to choose between one or the other, I'd do the MFT first. That puts any recovery effort to the task of scanning my drive and manually putting the files back together, at least. It's not secure, but just a priority of mine.

What's the advantage of wiping free space and/or MFT? :)

Here's one good reason: creating disk images.

I dual boot Windows and Linux and one of the things I really appreciate being able to do is create a block-level backup images of a fresh, properly updated and validated Windows partition as protection against corruption. (I just had to rebuild a friend's machine after a few bad sectors happened to take out the system hive of the registry, among other things.)

When creating a disk image, ZEROs compress much, much better than random noise or old data. I want a tool that will erase data not just for security, but so that any part of the drive that isn't actual data compresses to almost nothing very easily. Right now, I'm stuck with a disk image that is almost 10GB in size COMPRESSED when there are less than 5GB of data used on the disk. The MFT could be a sizable portion of that overhead, especially if some well-intended eraser program fills it with random noise instead of nice, clean zeros.

I can blank the unused blocks with Linux commands, but I'm not sure I can black out unused portions of the MFT the same way. That is at least one reason to have the "MFT only" option, but I wouldn't mind at all if it was included in a full wipe.

Hi scrib! Welcome to the forums!

Always nice to have a new resident Threadcromancer :lol: