Meadows Posted February 22, 2010 Share Posted February 22, 2010 Hi guys, Congratulations on the option to wipe MFT. I'm delighted with the results. I would like a menu option to go directly to wiping MFT, rather than having to wait for a full free disk space wipe. Any suggestions? Cheers, Meadows. Cheers, Meadows. Link to comment Share on other sites More sharing options...
Meadows Posted March 5, 2010 Author Share Posted March 5, 2010 Hi guys,Congratulations on the option to wipe MFT. I'm delighted with the results. I would like a menu option to go directly to wiping MFT, rather than having wait for a full free disk space wipe. Any suggestions? Cheers, Meadows. I can now answer my own question! My latest update (v2.29.1111) does the MFT wipe before the disk free space wipe. Very useful. Cheers, Meadows. Cheers, Meadows. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted March 5, 2010 Moderators Share Posted March 5, 2010 What's the advantage of overwriting the MFT before overwriting free space? Link to comment Share on other sites More sharing options...
marmite Posted March 5, 2010 Share Posted March 5, 2010 What's the advantage of overwriting the MFT before overwriting free space? ... and (from the topic title) what's the point of only overwriting MFT freespace? Link to comment Share on other sites More sharing options...
kroozer Posted March 5, 2010 Share Posted March 5, 2010 What's the advantage of wiping free space and/or MFT? Link to comment Share on other sites More sharing options...
Moderators Augeas Posted March 5, 2010 Moderators Share Posted March 5, 2010 I can see that some users would wish to overwrite free space and entries in the MFT from time to time, to ensure some perceived level of security. I just can't see why the order - MFT first or last - is important. But as Piriform changed the order, from MFT last to first, there must be some reason that I don't get. Having the ability to overwrite the MFT without overwriting free space shows that the process is not the same as that used by popular space overwriters, i.e. fill all the available free space so that the MFT can't expand, then create zero length files until the disk, and the MFT, is filled, then delete the lot. Without filling free space this method of clearing the MFT isn't available. I wonder if CC does a count of the total/used entries in the MFT, takes one from t'other, creates sufficient zero length files to fill the unused entries, then deletes them? Later edit: I thought that overwriting the MFT could be run independently, but from looking at the docs I'm not sure. Is it only valid if you have the overwrite free space option ticked as well? I guess it must be, as otherwise CC wouldn't know which drive to run Wipe MFT on. Link to comment Share on other sites More sharing options...
marmite Posted March 6, 2010 Share Posted March 6, 2010 Later edit: I thought that overwriting the MFT could be run independently, but from looking at the docs I'm not sure. I don't know how the MFT funtions in detail but that would make sense to me. If you're doing this from a security point of view there's no sense in cleaning the MFT but not the data. Assuming, of course, there's no other system operational or performance benefit to doing so. Link to comment Share on other sites More sharing options...
FearNothingProductions Posted March 6, 2010 Share Posted March 6, 2010 I suppose, theoretically one could run the WFS option, then cancel the action as soon as the MFT wipe was over. No, wait, that's a terrible idea. My vote goes toward these two being separate options for a future release. Of course the pen is mightier than the sword! You know who said that? The guy with the pen. Link to comment Share on other sites More sharing options...
marmite Posted March 6, 2010 Share Posted March 6, 2010 No, wait, that's a terrible idea. My vote goes toward these two being separate options for a future release. But to reiterate, I'm still looking for a reason why you would want to delete MFT freespace but not disk freespace. What is the benefit?! Link to comment Share on other sites More sharing options...
BuBBy Posted March 9, 2010 Share Posted March 9, 2010 But to reiterate, I'm still looking for a reason why you would want to delete MFT freespace but not disk freespace. What is the benefit?! The amount of MFT freespace would usually be much less than the amount of disk freespace - so I am guessing it would be faster to delete MFT freespace than to delete all disk freespace. Everyone is in a hurry these days. Link to comment Share on other sites More sharing options...
marmite Posted March 9, 2010 Share Posted March 9, 2010 The amount of MFT freespace would usually be much less than the amount of disk freespace - so I am guessing it would be faster to delete MFT freespace than to delete all disk freespace. Yep, but the only reason I'm aware of to delete MFT freespace is a security measure to erase MFT file metadata. Since the files themselves are still potentially in the unerased freespace, what's the gain? Surely the files themselves are the priority and MFT is just that bit extra. Erasing the latter without the former doesn't seem to achieve much. Link to comment Share on other sites More sharing options...
Meadows Posted March 15, 2010 Author Share Posted March 15, 2010 What's the advantage of overwriting the MFT before overwriting free space? Hi Guys. I notice that no-one sees any advantage in wiping MFT without doing a full disk wipe. Let me explain: I have a fast way to clean the disk. Lets assume we can start with a clean MFT and a clean disk. After use, especially online, we are going to have a number of deleted temp and other files which are recoverable. To overwrite them I go into RECUVA, scan for files, check all files in the "recoverable" list and select the option "Overwrite checked" . Disk free space is totally overwritten again (I know, maybe not totally...) Done in seconds instead of an hour or more required to overwrite disk free space in CCleaner. What I have is an incremental operation instead of a complete re-run. The only problem remaining is that Recuva can't overwrite in the MFT. Message "not overwritten...file is resident in MFT". So first I "wipe" MFT in CCleaner, then overwrite recoverable files in Recuva. Three minutes. Cheers, Meadows P.S. FearNothingProductions, I do run WFS and then stop it when MFT is finished. It is probably a "terrible idea" but seems to work for the mean time. Do you see any real dangers? Best idea is definitely separate options in a future release. Piriform? Cheers, Meadows. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted March 15, 2010 Moderators Share Posted March 15, 2010 Hi Meadows, I was curious to know what advantage there was in overwriting the MFT before overwriting free space, as opposed to overwriting free space first and then the MFT. This thread http://forum.piriform.com/index.php?showtopic=27221&hl= indicates that it is not possible to overwrite the MFT without overwriting free space. So how are you overwriting the MFT on its own? When you overwrite the MFT what indication is there that this has indeed been done? P.S. Just seen your PS. That explains how you do it (but 20 days after the thread started!). I can't see any great danger. What happens to the deleted file names in the MFT after running Wipe MFT this way? Link to comment Share on other sites More sharing options...
Meadows Posted March 15, 2010 Author Share Posted March 15, 2010 Hi Meadows, I was curious to know what advantage there was in overwriting the MFT before overwriting free space, as opposed to overwriting free space first and then the MFT. This thread http://forum.piriform.com/index.php?showtopic=27221&hl= indicates that it is not possible to overwrite the MFT without overwriting free space. So how are you overwriting the MFT on its own? When you overwrite the MFT what indication is there that this has indeed been done? P.S. Just seen your PS. That explains how you do it. I can't see any great danger. What happens to the deleted file names in the MFT after running Wipe MFT this way? Hi Augeas, the indication that it has been done is also in Recuva. After MFT wipe in CC go to Recuva and scan for recoverable files. The MFT is full of recoverable files of 600 zero bytes in the incremental zz...........zz format. The way CCleaner "wipes" the MFT is to create enough of these files to fill all the free space in the MFT and then delete them, thereby (I suppose) completely deleting or overwriting all the old filenames. Cheers, Meadows Cheers, Meadows. Link to comment Share on other sites More sharing options...
Meadows Posted March 15, 2010 Author Share Posted March 15, 2010 P.S. Just seen your PS. That explains how you do it (but 20 days after the thread started!). I can't see any great danger. What happens to the deleted file names in the MFT after running Wipe MFT this way? Oops, sorry about the 20 days - holiday in the sun. Cheers, Meadows. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted March 15, 2010 Moderators Share Posted March 15, 2010 I guess the only danger is that chopping the WFS option might leave one or more of the filler files that CC uses to overwrite free space in the root directory. Perhaps CC clears them up if you press Cancel, as opposed to a brute chop. Link to comment Share on other sites More sharing options...
Meadows Posted March 16, 2010 Author Share Posted March 16, 2010 Sure. Use the cancel button - that should clean up before exit. Cheers, Meadows. Link to comment Share on other sites More sharing options...
piriuser1 Posted April 10, 2010 Share Posted April 10, 2010 What's the advantage of wiping free space and/or MFT? Wipe MFT will wipe the unused MFT entries that point to old, deleted files on an NTFS drive. Wipe free space wipe the actual space on the hard disk that these files occupied. (And that are still there since deletion does not remove the data.) Separate note, for the person who asked why does it matter whether you do MFT then free space, or vice versa; my response is that if I personally had to choose between one or the other, I'd do the MFT first. That puts any recovery effort to the task of scanning my drive and manually putting the files back together, at least. It's not secure, but just a priority of mine. Link to comment Share on other sites More sharing options...
scrib Posted June 20, 2011 Share Posted June 20, 2011 What's the advantage of wiping free space and/or MFT? Here's one good reason: creating disk images. I dual boot Windows and Linux and one of the things I really appreciate being able to do is create a block-level backup images of a fresh, properly updated and validated Windows partition as protection against corruption. (I just had to rebuild a friend's machine after a few bad sectors happened to take out the system hive of the registry, among other things.) When creating a disk image, ZEROs compress much, much better than random noise or old data. I want a tool that will erase data not just for security, but so that any part of the drive that isn't actual data compresses to almost nothing very easily. Right now, I'm stuck with a disk image that is almost 10GB in size COMPRESSED when there are less than 5GB of data used on the disk. The MFT could be a sizable portion of that overhead, especially if some well-intended eraser program fills it with random noise instead of nice, clean zeros. I can blank the unused blocks with Linux commands, but I'm not sure I can black out unused portions of the MFT the same way. That is at least one reason to have the "MFT only" option, but I wouldn't mind at all if it was included in a full wipe. Link to comment Share on other sites More sharing options...
Winapp2.ini Posted June 20, 2011 Share Posted June 20, 2011 Hi scrib! Welcome to the forums! Always nice to have a new resident Threadcromancer winapp2.ini additions thread winapp2.ini github Link to comment Share on other sites More sharing options...
Moderators Augeas Posted June 20, 2011 Moderators Share Posted June 20, 2011 CC, and as far as i know other applications, will 'wipe' the MFT by creating sufficient small files to fill all MFT records and then deleting them - as explained in post 14 well over a year ago. Thus all these records will not contain zeroes but the info relating to the now deleted file. You will gain nothing in compressible data, it may be worse than before. In any event the MFT is comparatively small so you wouldn't gain a great deal. I would think that a zeroed MFT record, however you created it, would cause the validity checking to fail and would result in a corrupt MFT. Link to comment Share on other sites More sharing options...
Alan_B Posted June 21, 2011 Share Posted June 21, 2011 Right now, I'm stuck with a disk image that is almost 10GB in size COMPRESSED when there are less than 5GB of data used on the disk. I think you have allowed yourself to be stuck with an unsuitable imaging application or mode of disc image creation. I know that Macrium and Acronis give the choices (under different names) of Intelligent or Forensic images. An "Intelligent" copy disregards all the Free Space sectors A "Forensic" copy disregards nothing. Since a 5.98 GB Macrium image holds all 4 primary partitions with data space totalling 16.7 + 3.2 + 0.3 + 0.1 = 20.3 GB on my Win 7 machine, your 5 GB of data would have to be incredibly dense and incompressible to use even halve the information held in your 10 GB image. I would guess that it is more likely that your 5 GB would compress down below 3 GB and the remaining 7 GB of the image probably holds the information of 14 to 25 GB of free space and/or one ginormous MFT Link to comment Share on other sites More sharing options...
Super Fast Posted July 4, 2011 Share Posted July 4, 2011 + 1 from me! I had to upgrade memory on someone's computer & they are constantly adding/deleting/uninstalling/moving files on their machine. They were running XP just 512 MB RAM (using 530 to 600 something though!), so their computer ran very slow due to the virtual ram (harddisk page file) being used. I upgraded them to 1.25 GB ram, & it solved that problem, but their computer still ran like a turtle. After running the Wipe MFT function in CCleaner, it sped up like 10 times faster! No lie! Anyway, I would love to see CCleaner include just a MFT cleaner, because I had having to click cancel out. Just wastes disk thrashing when all you need is a MFT clean! Link to comment Share on other sites More sharing options...
Moderators Augeas Posted July 5, 2011 Moderators Share Posted July 5, 2011 Before we rush into another myth, I'd like to see any reasoning why 'Wipe MFT' would give any performance change. It replaces one deleted file name with another deleted file name. There are the same number of deleted MFT records, in the same position as before. Link to comment Share on other sites More sharing options...
Super Fast Posted July 7, 2011 Share Posted July 7, 2011 Before we rush into another myth, I'd like to see any reasoning why 'Wipe MFT' would give any performance change. It replaces one deleted file name with another deleted file name. There are the same number of deleted MFT records, in the same position as before. Augeas, I am not 100% sure... But I know it works. I wouldn't post here if it didn't. Light users may never run into the need to test this. But if your a heavy user like me, you definitely will from time to time. I assume that it is replacing the deleted file name with empty data, which causes windows to stop tracking the changes to that entry. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now