Louisaz Posted February 19, 2009 Share Posted February 19, 2009 It's obvious from the replies on this forum regarding file name deletion, that the MFT is a protected area on typical hard drives and that RECOVA's secure file deletion excludes the MFT-retained file names. Are there programs that "defrag" the MFT? A Google search indicates there are. IF so, would the file name of a deleted file be overwritten during the defrag? I understand that the program EVIDENCE ELIMINATOR will also remove all traces of the file contents -- including its MFT name. Today, I e-mailed them [EE] for confirmation. Their site suggests this is the case but doesn't specifically mention "MFT." I understand that using Ccleaner with the OPTION to overwrite the deleted file may also work. Is this true? CCleaner's instructions state: "Note: When CCleaner securely deletes files, it renames them with all Zs in the file name (for example, ZZZZZZZZ.ZZZ) for increased security. Since Recuva is recovering files that have already been deleted, it cannot change their names before it overwrites them." Presumably, RECUVA is recovering [prior to its secure deletion] files that have been deleted by CCleaner and renamed zzzzzzz.zzz. If this is correct -- problem solved. OR is the (e.g.) temp. folder's ORIGINAL name in the MFT forever?! While RECUVA's deletion protocol doesn't mess with the MFT, it seems probable that other methods may be able to delete the MFT file name. I would think that RECUVA's programmers would be very interested in having the capability to include the elimination of the file name as well as its contents. Comments? Suggestions? Thanks, Louis Link to comment Share on other sites More sharing options...
Guest MrRon Posted February 19, 2009 Share Posted February 19, 2009 When CCleaner securely deletes a file, it first renames the file with all Z's, it then overwrites the fragments, so this means this file is gone... forever. When Recuva overwrites a file it is dealing with files that have already been deleted, these are different from the types of files CCleaner deletes, this means that it is not possible to rename the file first. So when Recuva overwrites a file, it cannot overwrite the filename. The only way to remove the filename of an already deleted file, is to overwrite all the unused filenames in the MFT. We are working on this feature for a future version. MrRon Link to comment Share on other sites More sharing options...
Moderators Augeas Posted February 19, 2009 Moderators Share Posted February 19, 2009 As I understand, mainly from wasting time on Google (as anyone can do): When a slot in the MFT is allocated for a file the slot remains in the MFT forever The MFT never reduces in size Defrags will not overwrite filenames in empty MFT slots, or move anything into them New file allocations will attempt to use existing 'deleted' slots in the MFT What Ron said Nothing is ever deleted from a disk, just overwritten Diskwashers work by filling the disk with data and the MFT with dummy file names, then deleting all they've created Piriform developers know more than I do Link to comment Share on other sites More sharing options...
Louisaz Posted February 19, 2009 Author Share Posted February 19, 2009 When CCleaner securely deletes a file, it first renames the file with all Z's, it then overwrites the fragments, so this means this file is gone... forever.When Recuva overwrites a file it is dealing with files that have already been deleted, these are different from the types of files CCleaner deletes, this means that it is not possible to rename the file first. So when Recuva overwrites a file, it cannot overwrite the filename. The only way to remove the filename of an already deleted file, is to overwrite all the unused filenames in the MFT. We are working on this feature for a future version. MrRon MrRon, Thank you for that concise and helpful response. I get it. And I will "get" your future version that provides the file name deletion feature. Louis Link to comment Share on other sites More sharing options...
YoKenny Posted February 19, 2009 Share Posted February 19, 2009 Is EVIDENCE ELIMINATOR still using scare tactics and false advertising to promote their application? http://www.radsoft.net/software/reviews/ee/04.shtml http://ee-sucks.tripod.com/ee-lies.html "Education is what remains after one has forgotten everything he learned in school." - Albert Einstein IE7Pro user Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now