chris88 Posted November 17, 2009 Share Posted November 17, 2009 Hello everyone. I know that when some files are overwritten their file names are still left behind on the hard drive. I am simply curious as to whether this occurs when using the wipe free space option ( 7 overwrites) with ccleaner. I have read some conflicting answers ( some say the file name is overwritten with symbols, others say though the file itself is irretrievable, the name will still remain) While no real pressing issue, I am simply curious as to the correct answer. Thanks all! Link to comment Share on other sites More sharing options...
Moderators Augeas Posted November 17, 2009 Moderators Share Posted November 17, 2009 After running WFS you will still be able to see some deleted file names if you run an application such as Recuva. These file names are held in the Master File Table which WFS does not touch. Recuva may show a few thousand file names, whilst WFS has probably overwritten many tens of thousands of files. The majority of the deleted file names in the MFT will be overwritten with continued pc use, as new files are created. And new deleted file names will appear, in a rolling process (if that makes sense). Link to comment Share on other sites More sharing options...
chris88 Posted November 17, 2009 Author Share Posted November 17, 2009 Thank you so much for your response! So just to clarify, with basic computer use (and not using wipe free space option) deleted files and their space on the hard drive are routinely overwritten (with time) by others along with their filenames being erased? I have recently been interested in the ins and outs of computers and find all of this info simply fascinating. Thanks for your knowledge again! Link to comment Share on other sites More sharing options...
Moderators Augeas Posted November 18, 2009 Moderators Share Posted November 18, 2009 Well, sort of. As far as file names are concerned, these are held in the MFT. When a file is deleted its entry in the MFT is flagged as deleted but remains (the MFT never reduces in size). When a new file is created a deleted entry is used to store the new file name and the old name is completely removed. So the amount of deleted file entries in the MFT varies minute by minute as you use your pc, and hour by hour as Windows creates/deletes sys restore points, updates the prefetch list, applies sys updates etc, and your antivirus updates its data base. If you maintain your system with CC, for instance, then you will probably never have a 'full' MFT, there will be enough deleted entries available for reuse. Some deleted entries might possibly miss the reuse bandwagon, being in some remote corner of the MFT, and never get overwritten. This is no problem. However a good Windows update should catch most of these, I recently had a spare list of three entries after a Windows update (followed by an immediate CC run to get back some more slack). As for the actual file data on the drive, the same principle applies more or less. Old data will be overwritten, but inevitably there will be more scope for the data to be spread more widely, and there is no obligation on the O/S to overwrite old data, new data can be written anywhere. I imagine that due to the O/S trying to keep access time to a minimum most data will be written in the same area, not out on the end of the drive, so most data will get overwritten. Conversely, data that is out of the way somewhere will tend to miss the overwrite process and remain forever. A Recuva deep scan will show what data is out there on your disk, and a CC wipe free space should overwrite it. Personally I've only run deep scan twice in my life, and wipe free space never. I'd sooner read a good book. Link to comment Share on other sites More sharing options...
marmite Posted November 18, 2009 Share Posted November 18, 2009 Augeas while you're on a roll, what exactly does a deep scan do that an ordinary scan doesn't? Link to comment Share on other sites More sharing options...
Moderators Augeas Posted November 18, 2009 Moderators Share Posted November 18, 2009 Don't stop me now - a normal scan will look at and display the file names from the deleted file entries in the MFT. Only the MFT is scanned, nothing else on the hard drive. A deep scan will do the MFT part and also scan all the used clusters on the hard drive, and return the file names it finds in these clusters. I am not fully aware of the technique Recuva uses to either find or extract filenames from these clusters, presumably it looks for some known header info in each cluster and extracts the name there. I also don't know what it does if it finds a cluster with random data. I think there are files found called ? so these may be them, or they. A deep scan will return far more hits than the normal scan, and take far longer to run. My normal scan is around 1,600 hits, and deep scan around 70,000 hits. I'm sure others have far more as I am not a heavy pc user. Far too many books to read. (All subject, of course, to correction or ridicule from the Piriform chaps, who do know what their software does.) Link to comment Share on other sites More sharing options...
marmite Posted November 18, 2009 Share Posted November 18, 2009 Only the MFT is scanned, nothing else on the hard drive. A deep scan will do the MFT part and also scan all the used clusters on the hard drive. Ah, that makes sense. The cluster scan wouldn't need to worry about names I guess; just establish logical file chains. (All subject, of course, to correction or ridicule from the Piriform chaps, who do know what their software does.) Quite; caveat acknowledged Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now