Jump to content
CCleaner Community Forums
PiriFan

Wiping free space doesn't really work

Recommended Posts

I used the Recuva tool after running a lot of Wipe Free Space options (1 - 7 pass secure overwrites options each time) and Recuva was still able to locate files I had deleted from over six years ago. I just noticed the Gutmann overwrite option, will that remove those files for good? Also, does it actually improve the performance of the drive, or will it just replace readable files with unreadable misc data? Thanks :)

Share this post


Link to post
Share on other sites

Gutmann is a waste of time, it won't erase anymore than a single pass.

Wiping free space does not improve performance, it simply placates paranoia.

Are you seeing the complete files or just file names/fragments? Can you recover any of them?

Share this post


Link to post
Share on other sites
Gutmann is a waste of time, it won't erase anymore than a single pass.

Are you seeing the complete files or just file names/fragments? Can you recover any of them?

 

Not to mention many of the patterns used was designed for old machines which makes them useles to modern systems. Even gutmann has stated this.

 

"In fact performing the full 35-pass overwrite is pointless for any drive since it targets a blend of scenarios involving all types of (normally-used) encoding technology, which covers everything back to 30+-year-old MFM methods . If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes."

Share this post


Link to post
Share on other sites
My guess is Piriform offers the 35-pass option only to comply with user demand.

 

Was going to state this. It really is the only reason i can see it being used. But with out it there would be a flood of 35 passes suggestions.

Share this post


Link to post
Share on other sites
I used the Recuva tool after running a lot of Wipe Free Space options (1 - 7 pass secure overwrites options each time) and Recuva was still able to locate files I had deleted from over six years ago. I just noticed the Gutmann overwrite option, will that remove those files for good? Also, does it actually improve the performance of the drive, or will it just replace readable files with unreadable misc data? Thanks :)

 

Try selecting "Wipe MFT" in options.

 

The reason for this is that Recuva scans the MFT for pointers to files (as I understand it, feel free to correct me if I'm wrong.) overwriting space will remove files but not their pointers. This would mean were it that you deleted junk.jpg in 2002, it was overwritten by now (by you overwriting free space,) but theres still a pointer to it in the MFT (MFT is very large with many outliers that aren't written over for several years)

 

trying wiping the MFT and scanning with Recuva again.

 

My suggestion is that there should be a way to wipe ONLY mft, and not free space. Just a thought.

Share this post


Link to post
Share on other sites
My suggestion is that there should be a way to wipe ONLY mft, and not free space. Just a thought.

 

Yes, I fully agree!

Share this post


Link to post
Share on other sites

I guess Gutmann is now just about obsolete, except for very old computers. Long time ago I suggested it here, seemed like a good idea at the time, now seems to cause more stress that benefit for users.

 

... (MFT is very large with many outliers that aren't written over for several years)...

Hi, Winapp2.ini. I have a question, at the risk of hijacking this thread. I have read several places that the mft is never reduced in size, and that the "pointers" I guess, or maybe "entries" in the article below, may be reused but are not deleted.

 

I don't understand that. If it was true, by now my $mft should be spilling out onto the floor. :lol: I've been running this computer for 3 or 4 years, and have installed and uninstalled everything except maybe a toaster. It must be that I am missing something when reading the language of computer experts. Can you help clarify that?

 

The microsoft article: Microsoft Support

Share this post


Link to post
Share on other sites

That is true. MFT pointers are like files ; once they are deleted, they are marked as "free" by Windows. The next time Windows wants to create a file, it will search for the first available free entry and overwrite it with new data.

But they are never really deleted.

Share this post


Link to post
Share on other sites
I guess Gutmann is now just about obsolete, except for very old computers. Long time ago I suggested it here, seemed like a good idea at the time, now seems to cause more stress that benefit for users.

 

 

Hi, Winapp2.ini. I have a question, at the risk of hijacking this thread. I have read several places that the mft is never reduced in size, and that the "pointers" I guess, or maybe "entries" in the article below, may be reused but are not deleted.

 

I don't understand that. If it was true, by now my $mft should be spilling out onto the floor. :lol: I've been running this computer for 3 or 4 years, and have installed and uninstalled everything except maybe a toaster. It must be that I am missing something when reading the language of computer experts. Can you help clarify that?

 

The microsoft article: Microsoft Support

 

Its never reduced in size, but it doesn't have a definitive one either. Essentially its an index, and doesn't have a set size. It'll grow if you have more files and shrink if you have less. The pointers, once deleted are treated as MFT free space and will have a new pointer written into them eventually. You're probably not aware of it, but your computer writes and deletes thousands of files without telling you, which is why the MFT never runs out of space.

Share this post


Link to post
Share on other sites

Hi, Aethec. So is it that the mft sort of expands until it has room for all the files on the computer at that time , and as files are replaced the pointers/entries are re-allocated from a deleted file to a newly installed file? Eh? Am I gettin' there? :mellow:

Share this post


Link to post
Share on other sites

Hi, Winapp2.ini. That pretty much explains it, at least as much as I'll ever need to know. Two reasons for the question, really. One is a sort of galloping paranoia, or maybe a control issue. I want to be able to manage and control what is on my computer, after all it is mine. The other is that I wonder what it is that makes it gradually sloooow down, and wondered if it could be that expanding mft. Reason number one is a lost cause...ain't gonna happen. :P Reason two is apparently not an issue, apparently windows manages that file efficiently. Thinks thats right?

 

Edit: There is also a decent explanation of the MFT, which I just found here.

 

I guess lots of folks already know this, so thanks for your patience. :D

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
×
  • Create New...