Jump to content
CCleaner Community Forums

Wiping 'file names' from the MFT


Recommended Posts

A few months ago,i re-hashed several Excel files that i'd created,mostly to do with on-line banking & billing,none of these contained info.useable by anybody. I copied much of the old files onto the new ones & then used 'File Shredder' to shred the old files.I ran 'Recuva' to see what it could

recover,& there were the file names of all the Excel files that i'd 'Shredded'. Ok,that's fine,the info. within the fies was gone - period !,but suppose one of the files was called 'My £ million bank account' ( i wish !),then the very fact that the file name remains,would indicate to a 'person' that i did indeed have a £ million bank account,something that i'd maybe wish to keep to myself.

I did contact Piriform over this & they recommended that i run CCleaner's driver wiper using the Gutman process, to wipe the free space on the drive where the files had been kept. I did this a couple of days ago.It took close to 6 hours to run the driver wiper & at the end of it i ran Recuva to see if anything remained. Of the 6 Excel file names,5 had been wiped,but one still remained - how can that happen ??. The file location is given simply as H:\.....

Personally, i feel that if all the information inc.file names isn't going to be 'wiped',then we should at least be given a file 're-name' function within 'Recuva'. It's the only criticism that i have of the Piriform software that i use,that 'private' info.can still remain after a supposedly 'secure' deletion.

Link to post
Share on other sites
  • Moderators

Hi Saska.

 

Did you use the "Wipe Free Space" routine via "Tools\Drive Wiper"?

 

 

 

If you access that feature via "Options\Settings", you have extra options including "Wipe MFT Free Space".

 

 

 

Hope that helps,

Link to post
Share on other sites
  • Moderators

How could that happen (one Excel name remaining)? It could happen if Drive Wiper does not specifically wipe the MFT.

 

Wipe Free Space in Options/Settings has an option to wipe the MFT. Drive Wiper does not. Does Drive Wiper wipe the MFT by default? I don't know as I don't use it, perhaps some other user can confirm one way or the other.

 

If DW doesn't include wipe MFT, then its wipe free space operation will create new entries in the MFT, and possibly overwrite some of the Excel entries, leaving one by chance behind. If WFS had been used with wipe MFT checked then all the Excel entries should have been removed.

 

I think that the advice should have been to use WFS in Options/Settings, with wipe MFT checked. This will give you one (much faster) pass of the drive. Wiping 35 times, a la Gutmann, is a waste of time.

Link to post
Share on other sites

Quote - "Wiping 35 times, a la Gutmann, is a waste of time" .Well,that's your opinion !. I'd previously tried the single & 7 pass driver wipes,that's why i contacted Piriform in the first place,neither of those wiped anything. As for 'did i wipe the MFT' - look at the title of this thread. Only when i'd used the Gutman process to wipe the MFT,did i get any result at all.That's why it's so very puzzling as to why one single file name should remain after all the other's have been wiped - they were all (presumably) in the same place,within the MFT. I agree that all the Excel entries 'should' have been removed,but they weren't - that's the problem.

Link to post
Share on other sites
  • Moderators

And a happy Sunday morning to you too.

 

No it's not my opinion. Disk manufacturers have spent hundreds of millions of pounds, or more likely billions of renminbi, on ensuring that whatever was last written to a disk sector is what is presented to the operating system when read. If you write one pass of zeroes to a sector then what you get when you read it is zeroes, never, ever anything else. If you're reading something else then it hasn't been overwritten: the number of overwrites is irrelevant.

 

Is H the number of the drive you're overwriting? Is it a hd or flash or what? NTFS or FAT?

 

The title of this thread tells me nothing. After a pretty extensive search I can find no definitive statement that CC's Drive Wiper option includes an MFT wipe. Do you know that it does?

Link to post
Share on other sites

 

After a pretty extensive search I can find no definitive statement that CC's Drive Wiper option includes an MFT wipe. Do you know that it does?

 

 

Not sure about him, but yes, I know that it does.

 

Do a drive wipe, & it will begin the MFT wipe BEFORE it does the drive wipe.

 

You just have to launch drive wipe first.

Link to post
Share on other sites
  • Moderators

Right, it seems sensible that it would do a wipe MFT. What do you mean about launching drive wipe first? (I'll have to cadge a plug-in drive to test all this stuff.)

 

Now we need to know what file system the o/p's drive is, and what actually happened.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...