[v5, v6] What are Cluster Tips?

Frequently Asked Questions. Check to see that your question has not been answered here before posting in the Support Forum.

Moderators: Eraser DevTeam, Eraser Moderators

[v5, v6] What are Cluster Tips?

Postby Overwriter » Tue Dec 23, 2008 2:52 pm

A computer hard disk is divided into small areas called clusters. A file can cover several clusters however it is unusual that the size of a file turns out to be an exact fit of a cluster size.

A cluster tip is a portion of a disk cluster that has not been fully taken up with the file written to it. Think of it this way, if you wrote a sentence on some paper with a pencil and then wanted to use the exact same line on the paper for a different message you would normally use an eraser to rub out the sentence and write your new message in its place. Well, windows kind of does this with hard drives but crucially windows doesn’t erase the whole sentence, it only overwrites the sentence with the new message, so if the new message is shorter than the previous one you get a cluster tip. It’s a little more complicated than this but this is just a simple guide !

Example. (file written on drive cluster).

“This is my secret message, my bank PIN number is 12345678.”

Now the user deletes this file with windows delete. The MFT record is cleared so windows sees this cluster as empty.

Although deleted the actual physical sector still looks like this.

“This is my secret message, my bank PIN number is 12345678.”

So as far as the windows user is aware the message is deleted and gone but in reality the message is still there, just the record of it and its location have been deleted by windows.

Now, say windows writes new data to the very same cluster some time later, the sector would look like this.

“My new word doc ####, my bank PIN number is 12345678.”

The #### are where windows thinks the file ends in that cluster but as you can see, a forensic examination clearly shows your previous and private message you thought had been deleted some time ago is still there !

This is why it is important to select “wipe cluster tips” when performing a free space wipe with Eraser.
Want to help Eraser ? Read this. Found a bug in Eraser, please report it here. Eraser FAQ
User avatar
Eraser DevTeam
Posts: 1068
Joined: Wed Nov 15, 2006 4:48 pm

Re: [v5, v6] What are Cluster Tips?

Postby nexthder » Thu Jun 11, 2009 5:29 am

Great msg, it be useful, thanks. :roll:
Posts: 2
Joined: Thu Jun 11, 2009 5:25 am

Re: [v5, v6] What are Cluster Tips?

Postby melen001 » Sat Sep 14, 2013 7:23 pm

Hi Overwriter,

I was wondering what Cluster Tips are and you have explained it very clearly in a simple, right to the point and understandable manner. So like you say it's wise and really makes sense to choose "Wipe Cluster Tips" option when performing "free space wipe" using Eraser. Thanks a lot for the explanation. English is my second language so I value easy and "right to the point" instructions.
Posts: 3
Joined: Wed Sep 11, 2013 9:57 pm

Re: [v5, v6] What are Cluster Tips?

Postby Sarah2117 » Wed Jan 15, 2014 3:31 pm

Nice explanation alright. I had been wondering what exactly it / they were for a while since i heard someone mention it a while back.

Now i can bring it up in a conversation and not feel silly this time around :)

Posts: 2
Joined: Wed Oct 23, 2013 1:19 am

Return to Eraser FAQ

Who is online

Users browsing this forum: No registered users and 2 guests