Cleaning/Wiping Free Space

[NewToPiriform]

Hi I tried cleaning the free space on a USB drive with CCleaner, as I was preparing to sell it, by:

 

1. going to options -> settings -> secure deltion (secure file deletion slower) -> simple overwrite 1 pass, selecting the usb drive, and checking "wipe MFT free space"

2. going to cleaner -> windows -> then checking the "wipe free space option" (the very last option in the list)

 

Then when it had finished I ran recuva to see if the free space had been deleted.

When I selected:

options -> actions -> deep scan

the names of all of the files that were on the USB were listed although they were in "red condition" and I could not recover them.

 

Why are all of my file names and files still on the drive, when these files should have been properly deleted?

Is the wipe free space option broken, or being developed further, or do I need to use another product such as kill disk or DBAN in order to wipe the USB properly before selling it?

[Willy2]

When you select the option Wipe Free Space (WFS) then only the free disk space is overwritten and not the MFT (Master File Table) that contains info what the file names are and where those files are stored. If you want the file names to be deleted as well, then you should select the Wipe MFT space (WMS) as well.

 

To speed up that cleaning process I would recommend to do the following:

1. Run CC with WFS selected but don't select WMS

2. Run CC again with both WFS and WMS selected.

Especially when you have A LOT OF free disk space this particular sequence can save A LOT OF time.

[NewToPiriform]

Hi Willy2 thanks for your fast reply.

When I ran CCleaner I had both "Wipe Free Space Drives" (WFSD) and "Wipe MFT Free Space" (WMFS) ticked in the options/settings section and "Wipe Free Space" (WFS) ticked in the cleaner/windows section. Shouldn't this have deleted both the files and the Master File Table, ie why is step 1 necessary?

[Alan_B]

What is your O.S. ?

Win 98 or XP etc. ?

 

What is your USB drive ?

2 TB ?

Hard drive or Flash ?

 

Does it use the USB at USB2 speed, or could it be limited to USB1 speed ?

Perhaps it is limited by computer / USB Hub design, or Drive configuration etc.

 

How is it formatted, NTFS or FAT32 or ?

 

Alan

[Willy2]

I recommend the sequence mentioned above because it the MFT is created dynamically by Windows. It expands and it contracts (at least, in Windows XP) depending on how much free space there's available. When the MFT has expanded then it can can take a VERY long time to overwrite info in the MFT, especially when you have a lot of free diskspace. When you run WFS first without wiping the MFT then the MFT is forced to contract to a minimum size. And then overwriting the MFT takes much less time.

 

I think the Piriform folks should take this account and reprogram the Wipe Free Space + MFT options. i.e. first Wipe Free Space and secondly wipe the MFT instead of the other way around.

[NewToPiriform]

Hi Alan

 

XP Home Service Pack 3

The USB drive is an Imation 8GB flash drive ie not an external hard drive.

Formatted NTFS.

 

Hi Willy

 

As I had deleted all of the files from the USB and I had the "Wipe MFT Free Space" (WMFS) ticked, CCleaner should have securely overwritten all of the files and the file names from the MFT.

 

Thinking about it, there are probably 2 ways of approaching the overwriting operation:

1. Overwriting all of the areas on the drive not currently being used ie all of the free space, or

2. Delete only the areas on the drive that are marked as having at some point contained a file via the MFT

 

If CCleaner wanted to use approach 1, then it would have to overwrite all the free space on the drive, and then to finish the job it would have to remove any deleted files from the MFT. If CCleaner were to use approach 2, then they would need to use the MFT to examine where on the drive to overwrite, before deleting the files from the MFT.

 

Although I can't be certain, due to the time involved, I think CCleaner overwrites all of the free space, not just the areas on the drive that are marked as having contained data in the MFT. In this case the order shouldn't matter. Option 1 is more secure as the MFT might not be accurate, while option 2 would be faster.

 

It could be that CCleaner overwrites the free space, but forgets to remove any overwritten or deleted files from the MFT.

[Augeas]

Can you confirm that the drive is NTFS, as most flash drives are shipped as some variant of FAT to enable them to be accessed on multiple hosts. If it isn't NTFS then CC won't wipe the file names from the file tables.

 

If you're really concerned about leaving any trace of data on the drive then I would use one of the specialist disk cleaners such as Eraser: CC isn't a forensic cleaner.

 

I won't comment on cleaning the MFT until you've checked the file system on the drive.

[NewToPiriform]

Hi Augeas, I double checked the drive and it is definitely NTFS, I remember formatting it.

[Willy2]

I must add something to post #2: When CC has completed overwriting the MFT in step 2 and starts to wipe the free space (again) I always cancel the operation.

 

I would recommend Clean Disk Security 7.8 to REALLY overwrite fileinfo. Then even Recuva can't recover any files anymore.

http://www.theabsolu...re/clndisk.html

It follows the sequence as described in post #2.