Jump to content

Wipe MFT only.


Meadows

Recommended Posts

Hi guys,

Congratulations on the option to wipe MFT. I'm delighted with the results. I would like a menu option to go directly to wiping MFT, rather than having to wait for a full free disk space wipe. Any suggestions?

Cheers, Meadows.

Cheers, Meadows.
Link to comment
Share on other sites

  • 2 weeks later...
Hi guys,

Congratulations on the option to wipe MFT. I'm delighted with the results. I would like a menu option to go directly to wiping MFT, rather than having wait for a full free disk space wipe. Any suggestions?

Cheers, Meadows.

 

 

I can now answer my own question! My latest update (v2.29.1111) does the MFT wipe before the disk free space wipe. Very useful.

Cheers, Meadows.

Cheers, Meadows.
Link to comment
Share on other sites

  • Moderators

I can see that some users would wish to overwrite free space and entries in the MFT from time to time, to ensure some perceived level of security. I just can't see why the order - MFT first or last - is important. But as Piriform changed the order, from MFT last to first, there must be some reason that I don't get.

 

Having the ability to overwrite the MFT without overwriting free space shows that the process is not the same as that used by popular space overwriters, i.e. fill all the available free space so that the MFT can't expand, then create zero length files until the disk, and the MFT, is filled, then delete the lot. Without filling free space this method of clearing the MFT isn't available. I wonder if CC does a count of the total/used entries in the MFT, takes one from t'other, creates sufficient zero length files to fill the unused entries, then deletes them?

 

Later edit: I thought that overwriting the MFT could be run independently, but from looking at the docs I'm not sure. Is it only valid if you have the overwrite free space option ticked as well? I guess it must be, as otherwise CC wouldn't know which drive to run Wipe MFT on.

Link to comment
Share on other sites

Later edit: I thought that overwriting the MFT could be run independently, but from looking at the docs I'm not sure.

I don't know how the MFT funtions in detail but that would make sense to me. If you're doing this from a security point of view there's no sense in cleaning the MFT but not the data. Assuming, of course, there's no other system operational or performance benefit to doing so.

Link to comment
Share on other sites

I suppose, theoretically one could run the WFS option, then cancel the action as soon as the MFT wipe was over.

 

No, wait, that's a terrible idea. My vote goes toward these two being separate options for a future release. :)

Of course the pen is mightier than the sword! You know who said that?

 

The guy with the pen.

Link to comment
Share on other sites

No, wait, that's a terrible idea. My vote goes toward these two being separate options for a future release. :)

But to reiterate, I'm still looking for a reason why you would want to delete MFT freespace but not disk freespace. What is the benefit?!

Link to comment
Share on other sites

But to reiterate, I'm still looking for a reason why you would want to delete MFT freespace but not disk freespace. What is the benefit?!

 

The amount of MFT freespace would usually be much less than the amount of disk freespace - so I am guessing it would be faster to delete MFT freespace than to delete all disk freespace.

 

Everyone is in a hurry these days. ;)

Link to comment
Share on other sites

The amount of MFT freespace would usually be much less than the amount of disk freespace - so I am guessing it would be faster to delete MFT freespace than to delete all disk freespace.

Yep, but the only reason I'm aware of to delete MFT freespace is a security measure to erase MFT file metadata. Since the files themselves are still potentially in the unerased freespace, what's the gain? Surely the files themselves are the priority and MFT is just that bit extra. Erasing the latter without the former doesn't seem to achieve much.

Link to comment
Share on other sites

What's the advantage of overwriting the MFT before overwriting free space?

 

Hi Guys. I notice that no-one sees any advantage in wiping MFT without doing a full disk wipe.

Let me explain: I have a fast way to clean the disk.

 

Lets assume we can start with a clean MFT and a clean disk. After use, especially online, we are going to have a number of deleted temp and other files which are recoverable. To overwrite them I go into RECUVA, scan for files, check all files in the "recoverable" list and select the option "Overwrite checked" . Disk free space is totally overwritten again (I know, maybe not totally...) Done in seconds instead of an hour or more :D required to overwrite disk free space in CCleaner. What I have is an incremental operation instead of a complete re-run.

 

The only problem remaining is that Recuva can't overwrite in the MFT. Message "not overwritten...file is resident in MFT". So first I "wipe" MFT in CCleaner, then overwrite recoverable files in Recuva. Three minutes.

 

Cheers, Meadows

 

 

P.S. FearNothingProductions, I do run WFS and then stop it when MFT is finished. It is probably a "terrible idea" but seems to work for the mean time. Do you see any real dangers?

 

Best idea is definitely separate options in a future release. Piriform? :rolleyes:

Cheers, Meadows.
Link to comment
Share on other sites

  • Moderators

Hi Meadows, I was curious to know what advantage there was in overwriting the MFT before overwriting free space, as opposed to overwriting free space first and then the MFT.

 

This thread http://forum.piriform.com/index.php?showtopic=27221&hl= indicates that it is not possible to overwrite the MFT without overwriting free space. So how are you overwriting the MFT on its own? When you overwrite the MFT what indication is there that this has indeed been done?

 

P.S. Just seen your PS. That explains how you do it (but 20 days after the thread started!). I can't see any great danger. What happens to the deleted file names in the MFT after running Wipe MFT this way?

Link to comment
Share on other sites

Hi Meadows, I was curious to know what advantage there was in overwriting the MFT before overwriting free space, as opposed to overwriting free space first and then the MFT.

 

This thread http://forum.piriform.com/index.php?showtopic=27221&hl= indicates that it is not possible to overwrite the MFT without overwriting free space. So how are you overwriting the MFT on its own? When you overwrite the MFT what indication is there that this has indeed been done?

 

P.S. Just seen your PS. That explains how you do it. I can't see any great danger. What happens to the deleted file names in the MFT after running Wipe MFT this way?

 

Hi Augeas, the indication that it has been done is also in Recuva. After MFT wipe in CC go to Recuva and scan for recoverable files. The MFT is full of recoverable files of 600 zero bytes in the incremental zz...........zz format. The way CCleaner "wipes" the MFT is to create enough of these files to fill all the free space in the MFT and then delete them, thereby (I suppose) completely deleting or overwriting all the old filenames.

 

Cheers, Meadows

Cheers, Meadows.
Link to comment
Share on other sites

P.S. Just seen your PS. That explains how you do it (but 20 days after the thread started!). I can't see any great danger. What happens to the deleted file names in the MFT after running Wipe MFT this way?

 

 

Oops, sorry about the 20 days - holiday in the sun. B)

Cheers, Meadows.
Link to comment
Share on other sites

  • Moderators

I guess the only danger is that chopping the WFS option might leave one or more of the filler files that CC uses to overwrite free space in the root directory. Perhaps CC clears them up if you press Cancel, as opposed to a brute chop.

Link to comment
Share on other sites

  • 4 weeks later...
What's the advantage of wiping free space and/or MFT? :)

 

Wipe MFT will wipe the unused MFT entries that point to old, deleted files on an NTFS drive.

 

Wipe free space wipe the actual space on the hard disk that these files occupied. (And that are still there since deletion does not remove the data.)

 

Separate note, for the person who asked why does it matter whether you do MFT then free space, or vice versa; my response is that if I personally had to choose between one or the other, I'd do the MFT first. That puts any recovery effort to the task of scanning my drive and manually putting the files back together, at least. It's not secure, but just a priority of mine.

Link to comment
Share on other sites

  • 1 year later...

What's the advantage of wiping free space and/or MFT? :)

 

Here's one good reason: creating disk images.

I dual boot Windows and Linux and one of the things I really appreciate being able to do is create a block-level backup images of a fresh, properly updated and validated Windows partition as protection against corruption. (I just had to rebuild a friend's machine after a few bad sectors happened to take out the system hive of the registry, among other things.)

 

When creating a disk image, ZEROs compress much, much better than random noise or old data. I want a tool that will erase data not just for security, but so that any part of the drive that isn't actual data compresses to almost nothing very easily. Right now, I'm stuck with a disk image that is almost 10GB in size COMPRESSED when there are less than 5GB of data used on the disk. The MFT could be a sizable portion of that overhead, especially if some well-intended eraser program fills it with random noise instead of nice, clean zeros.

 

I can blank the unused blocks with Linux commands, but I'm not sure I can black out unused portions of the MFT the same way. That is at least one reason to have the "MFT only" option, but I wouldn't mind at all if it was included in a full wipe.

Link to comment
Share on other sites

  • Moderators

CC, and as far as i know other applications, will 'wipe' the MFT by creating sufficient small files to fill all MFT records and then deleting them - as explained in post 14 well over a year ago. Thus all these records will not contain zeroes but the info relating to the now deleted file. You will gain nothing in compressible data, it may be worse than before. In any event the MFT is comparatively small so you wouldn't gain a great deal.

 

I would think that a zeroed MFT record, however you created it, would cause the validity checking to fail and would result in a corrupt MFT.

Link to comment
Share on other sites

Right now, I'm stuck with a disk image that is almost 10GB in size COMPRESSED when there are less than 5GB of data used on the disk.

I think you have allowed yourself to be stuck with an unsuitable imaging application or mode of disc image creation.

 

I know that Macrium and Acronis give the choices (under different names) of Intelligent or Forensic images.

An "Intelligent" copy disregards all the Free Space sectors

A "Forensic" copy disregards nothing.

 

Since a 5.98 GB Macrium image holds all 4 primary partitions with data space totalling 16.7 + 3.2 + 0.3 + 0.1 = 20.3 GB on my Win 7 machine,

your 5 GB of data would have to be incredibly dense and incompressible to use even halve the information held in your 10 GB image.

I would guess that it is more likely that your 5 GB would compress down below 3 GB and the remaining 7 GB of the image probably holds the information of 14 to 25 GB of free space and/or one ginormous MFT

Link to comment
Share on other sites

  • 2 weeks later...

+ 1 from me!

 

I had to upgrade memory on someone's computer & they are constantly adding/deleting/uninstalling/moving files on their machine.

 

They were running XP just 512 MB RAM (using 530 to 600 something though!), so their computer ran very slow due to the virtual ram (harddisk page file) being used.

I upgraded them to 1.25 GB ram, & it solved that problem, but their computer still ran like a turtle.

 

After running the Wipe MFT function in CCleaner, it sped up like 10 times faster! No lie!

 

Anyway, I would love to see CCleaner include just a MFT cleaner, because I had having to click cancel out.

Just wastes disk thrashing when all you need is a MFT clean!

Link to comment
Share on other sites

  • Moderators

Before we rush into another myth, I'd like to see any reasoning why 'Wipe MFT' would give any performance change. It replaces one deleted file name with another deleted file name. There are the same number of deleted MFT records, in the same position as before.

Link to comment
Share on other sites

Before we rush into another myth, I'd like to see any reasoning why 'Wipe MFT' would give any performance change. It replaces one deleted file name with another deleted file name. There are the same number of deleted MFT records, in the same position as before.

Augeas, I am not 100% sure...

 

But I know it works.

I wouldn't post here if it didn't.

 

Light users may never run into the need to test this.

But if your a heavy user like me, you definitely will from time to time.

 

I assume that it is replacing the deleted file name with empty data, which causes windows to stop tracking the changes to that entry.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.