Ticket #23 (new enhancement)
Make ghost MFT-records more empty
| Reported by: | Shredder | Owned by: | |
|---|---|---|---|
| Priority: | critical | Milestone: | Eraser 6.1/6.2 |
| Component: | Core | Version: | |
| Keywords: | Cc: | ||
| Processor Architecture: | Blocked By: | ||
| Blocking: | Operating System: |
Description
I think Eraser should make ghost MFT-records which it leaves behind more empty. Currently they contain at least Timestamps which reveals when Eraser was used. Also it seems that every filesystem research tool lists them by default as deleted files.
If you need to proof that it is possible to overcome these caveats, take a look at following examples.
Here's Example NTFS MFT-record after Eraser has done overwrite of Master File Table record:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 41035D400 46 49 4C 45 30 00 03 00 8F FE 5A 8B 05 00 00 00 FILE0...þZ‹.... 41035D410 11 00 02 00 38 00 00 00 68 03 00 00 00 04 00 00 ....8...h....... 41035D420 00 00 00 00 00 00 00 00 04 00 00 00 8D 98 00 00 ............˜.. 41035D430 04 00 30 00 00 00 00 00 10 00 00 00 60 00 00 00 ..0.........`... 41035D440 00 00 00 00 00 00 00 00 48 00 00 00 18 00 00 00 ........H....... 41035D450 1E 7C BF DF F2 C3 C7 01 1E 7C BF DF F2 C3 C7 01 .|¿ßòÃÇ..|¿ßòÃÇ. 41035D460 1E 7C BF DF F2 C3 C7 01 1E 7C BF DF F2 C3 C7 01 .|¿ßòÃÇ..|¿ßòÃÇ. 41035D470 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ............... 41035D480 00 00 00 00 38 06 00 00 00 00 00 00 00 00 00 00 ....8........... 41035D490 00 00 00 00 00 00 00 00 30 00 00 00 70 00 00 00 ........0...p... 41035D4A0 00 00 00 00 00 00 03 00 52 00 00 00 18 00 01 00 ........R....... 41035D4B0 8C 98 00 00 00 00 06 00 1E 7C BF DF F2 C3 C7 01 Œ˜.......|¿ßòÃÇ. 41035D4C0 1E 7C BF DF F2 C3 C7 01 1E 7C BF DF F2 C3 C7 01 .|¿ßòÃÇ..|¿ßòÃÇ. 41035D4D0 1E 7C BF DF F2 C3 C7 01 00 00 00 00 00 00 00 00 .|¿ßòÃÇ......... 41035D4E0 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 ........ ....... 41035D4F0 08 02 30 00 30 00 30 00 30 00 30 00 30 00 7E 00 ..0.0.0.0.0.0.~. 41035D500 31 00 30 00 30 00 30 00 30 00 00 00 40 02 00 00 1.0.0.0.0...@... 41035D510 00 00 00 00 00 00 02 00 24 02 00 00 18 00 01 00 ........$....... 41035D520 8C 98 00 00 00 00 06 00 1E 7C BF DF F2 C3 C7 01 Œ˜.......|¿ßòÃÇ. 41035D530 1E 7C BF DF F2 C3 C7 01 1E 7C BF DF F2 C3 C7 01 .|¿ßòÃÇ..|¿ßòÃÇ. 41035D540 1E 7C BF DF F2 C3 C7 01 00 00 00 00 00 00 00 00 .|¿ßòÃÇ......... 41035D550 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 ........ ....... 41035D560 F1 01 30 00 30 00 30 00 30 00 30 00 30 00 30 00 ñ.0.0.0.0.0.0.0. 41035D570 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D580 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D590 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D5A0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D5B0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D5C0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D5D0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D5E0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D5F0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 04 00 0.0.0.0.0.0.0... 41035D600 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D610 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D620 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D630 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D640 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D650 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D660 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D670 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D680 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D690 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D6A0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D6B0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D6C0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D6D0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D6E0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D6F0 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D700 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D710 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D720 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 0.0.0.0.0.0.0.0. 41035D730 30 00 30 00 30 00 30 00 30 00 30 00 39 00 38 00 0.0.0.0.0.0.9.8. 41035D740 35 00 38 00 00 00 00 00 80 00 00 00 18 00 00 00 5.8.....€....... 41035D750 00 00 18 00 00 00 01 00 00 00 00 00 18 00 00 00 ................ 41035D760 FF FF FF FF 82 79 47 11 00 00 00 00 00 00 00 00 ÿÿÿÿ‚yG......... 41035D770 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D790 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ................
Same record after Directory Snoop's Purge command:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 41035D400 46 49 4C 45 30 00 03 00 00 00 00 00 00 00 00 00 FILE0........... 41035D410 11 00 00 00 38 00 00 00 40 00 00 00 00 04 00 00 ....8...@....... 41035D420 00 00 00 00 00 00 00 00 00 00 00 00 8D 98 00 00 ............˜.. 41035D430 04 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 ........ÿÿÿÿ.... 41035D440 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D450 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D460 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D470 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D480 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D4A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D4B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D4C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D4D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D4E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D4F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D520 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D550 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D560 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D570 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D590 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D5A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D5B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D5C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D5D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D5E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D5F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ................ 41035D600 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D610 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D620 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D630 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D650 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D6A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D6B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D6C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D6D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D6E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D6F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D700 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D710 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D720 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D730 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D740 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D750 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D770 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D780 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D790 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 41035D7F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ................
-No timestamps
-Research programs that I have tried don't list this kind of records as deleted (at least not by default)
So apparently there is still room for improvement..
Blocking
| Id | Summary | Milestone |
|---|---|---|
| #23 | └ Make ghost MFT-records more empty | Eraser 6.1/6.2 |
| #22 | └ MFT and Directory Entries erasure | Eraser 6.1/6.2 |
Blocked by
| Id | Summary | Milestone |
|---|---|---|
| #23 | └ Make ghost MFT-records more empty | Eraser 6.1/6.2 |
Change History
comment:2 Changed 5 years ago by Overwriter
I am a little concerned this ticket has been set for V6.1 or V6.2. Also “enhancement” should really be “defect” surly ?
Isn’t this the entire point of Eraser ? I just don’t want every wannabe forensic guy with a hex editor claiming Eraser V6 doesn’t work properly after its initial release !
A bad report by anyone reviewing Eraser V6 early on would be hard to shake off. V6 has had too much time and work on it to risk it I believe.
It would be the equivalent of an encryption program being broken on its first release, no one would ever trust it again.
Please Joel can this be addressed before a full version release of V6 ? Also ticket 54.
Note: See
TracTickets for help on using
tickets.
