Ticket #203 (new enhancement)

Opened 6 years ago

Last modified 5 years ago

Compact & truncate MFT (NTFS)

Reported by: Shredder Owned by:
Priority: critical Milestone: Eraser 6.1/6.2
Component: Core Version:
Keywords: Cc:
Processor Architecture: Blocked By:
Blocking: Operating System:


Paragon Total Defrag (http://www.paragon-software.com/home/total-defrag/) has a nice Compact & truncate MFT feature, which I would like to see in Eraser. It moves all active MFT-records after each other in the MFT so that there is no ghost records in between and then in shrinks MFT from the end so that there is no free records at all.

-Consider option where number of free records at the end of MFT can be adjusted
-Paragon total defrag can do this only at boot time, if partition is in use. Don't know if this is the only way to do it?

I'm not expert but perhaps this feature could also offer some anti-foresnic benefit since if there is no several thousands free records floating in the MFT then the natural record re-use cycle is much faster.


#203Compact & truncate MFT (NTFS)Eraser 6.1/6.2

Blocked by

#203Compact & truncate MFT (NTFS)Eraser 6.1/6.2

Change History

comment:1 Changed 6 years ago by Joel

  • Component changed from None to Core
  • Milestone set to Eraser 6.1/6.2

Based on my knowledge this isn't currently possible. I'll schedule it for 6.1

comment:2 Changed 5 years ago by Joel

  • Priority changed from major to critical

comment:3 Changed 5 years ago by BloodySword

I think it is very unsecure to do so, what if eraser crashes while processing or the drive is attached via usb and the usb protocol begins to hang?

comment:4 Changed 5 years ago by Shredder

Yes, there are risks involved but I think that with careful implementation those can be minimized. For example trying to sort whole MFT in memory and then dump it down to disk as one big blob would be risky. I think the safest way would be to do this record by record. Just a rough example:
1)Lock drive and disable everything which could hinder (caching??)
2)In a loop do
-Find currently first free mft entry n
-Copy and modify currently the last active mft entry x to n
-Read n and verify n == x (record number exluded)
-Erase entry x

Note: See TracTickets for help on using tickets.