Ticket #23 (new enhancement)

Opened 6 years ago

Last modified 5 years ago

Make ghost MFT-records more empty

Reported by: Shredder Owned by:
Priority: critical Milestone: Eraser 6.1/6.2
Component: Core Version:
Keywords: Cc:
Processor Architecture: Blocked By:
Blocking: Operating System:

Description

I think Eraser should make ghost MFT-records which it leaves behind more empty. Currently they contain at least Timestamps which reveals when Eraser was used. Also it seems that every filesystem research tool lists them by default as deleted files.

If you need to proof that it is possible to overcome these caveats, take a look at following examples.

Here's Example NTFS MFT-record after Eraser has done overwrite of Master File Table record:

Offset       0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

41035D400   46 49 4C 45 30 00 03 00  8F FE 5A 8B 05 00 00 00   FILE0...þZ‹....
41035D410   11 00 02 00 38 00 00 00  68 03 00 00 00 04 00 00   ....8...h.......
41035D420   00 00 00 00 00 00 00 00  04 00 00 00 8D 98 00 00   ............˜..
41035D430   04 00 30 00 00 00 00 00  10 00 00 00 60 00 00 00   ..0.........`...
41035D440   00 00 00 00 00 00 00 00  48 00 00 00 18 00 00 00   ........H.......
41035D450   1E 7C BF DF F2 C3 C7 01  1E 7C BF DF F2 C3 C7 01   .|¿ßòÃÇ..|¿ßòÃÇ.
41035D460   1E 7C BF DF F2 C3 C7 01  1E 7C BF DF F2 C3 C7 01   .|¿ßòÃÇ..|¿ßòÃÇ.
41035D470   20 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00    ...............
41035D480   00 00 00 00 38 06 00 00  00 00 00 00 00 00 00 00   ....8...........
41035D490   00 00 00 00 00 00 00 00  30 00 00 00 70 00 00 00   ........0...p...
41035D4A0   00 00 00 00 00 00 03 00  52 00 00 00 18 00 01 00   ........R.......
41035D4B0   8C 98 00 00 00 00 06 00  1E 7C BF DF F2 C3 C7 01   Œ˜.......|¿ßòÃÇ.
41035D4C0   1E 7C BF DF F2 C3 C7 01  1E 7C BF DF F2 C3 C7 01   .|¿ßòÃÇ..|¿ßòÃÇ.
41035D4D0   1E 7C BF DF F2 C3 C7 01  00 00 00 00 00 00 00 00   .|¿ßòÃÇ.........
41035D4E0   00 00 00 00 00 00 00 00  20 00 00 00 00 00 00 00   ........ .......
41035D4F0   08 02 30 00 30 00 30 00  30 00 30 00 30 00 7E 00   ..0.0.0.0.0.0.~.
41035D500   31 00 30 00 30 00 30 00  30 00 00 00 40 02 00 00   1.0.0.0.0...@...
41035D510   00 00 00 00 00 00 02 00  24 02 00 00 18 00 01 00   ........$.......
41035D520   8C 98 00 00 00 00 06 00  1E 7C BF DF F2 C3 C7 01   Œ˜.......|¿ßòÃÇ.
41035D530   1E 7C BF DF F2 C3 C7 01  1E 7C BF DF F2 C3 C7 01   .|¿ßòÃÇ..|¿ßòÃÇ.
41035D540   1E 7C BF DF F2 C3 C7 01  00 00 00 00 00 00 00 00   .|¿ßòÃÇ.........
41035D550   00 00 00 00 00 00 00 00  20 00 00 00 00 00 00 00   ........ .......
41035D560   F1 01 30 00 30 00 30 00  30 00 30 00 30 00 30 00   ñ.0.0.0.0.0.0.0.
41035D570   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D580   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D590   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D5A0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D5B0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D5C0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D5D0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D5E0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D5F0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 04 00   0.0.0.0.0.0.0...
41035D600   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D610   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D620   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D630   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D640   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D650   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D660   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D670   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D680   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D690   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D6A0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D6B0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D6C0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D6D0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D6E0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D6F0   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D700   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D710   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D720   30 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   0.0.0.0.0.0.0.0.
41035D730   30 00 30 00 30 00 30 00  30 00 30 00 39 00 38 00   0.0.0.0.0.0.9.8.
41035D740   35 00 38 00 00 00 00 00  80 00 00 00 18 00 00 00   5.8.....€.......
41035D750   00 00 18 00 00 00 01 00  00 00 00 00 18 00 00 00   ................
41035D760   FF FF FF FF 82 79 47 11  00 00 00 00 00 00 00 00   ÿÿÿÿ‚yG.........
41035D770   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D780   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D790   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7A0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7B0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7C0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7D0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 04 00   ................ 

Same record after Directory Snoop's Purge command:

Offset       0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

41035D400   46 49 4C 45 30 00 03 00  00 00 00 00 00 00 00 00   FILE0...........
41035D410   11 00 00 00 38 00 00 00  40 00 00 00 00 04 00 00   ....8...@.......
41035D420   00 00 00 00 00 00 00 00  00 00 00 00 8D 98 00 00   ............˜..
41035D430   04 00 00 00 00 00 00 00  FF FF FF FF 00 00 00 00   ........ÿÿÿÿ....
41035D440   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D450   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D460   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D470   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D480   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D490   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D4A0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D4B0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D4C0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D4D0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D4E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D4F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D500   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D510   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D520   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D530   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D540   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D550   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D560   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D570   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D580   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D590   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D5A0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D5B0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D5C0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D5D0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D5E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D5F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 04 00   ................
41035D600   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D610   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D620   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D630   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D640   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D650   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D660   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D670   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D680   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D690   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D6A0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D6B0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D6C0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D6D0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D6E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D6F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D700   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D710   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D720   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D730   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D740   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D750   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D760   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D770   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D780   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D790   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7A0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7B0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7C0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7D0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
41035D7F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 04 00   ................ 

-No timestamps
-Research programs that I have tried don't list this kind of records as deleted (at least not by default)

So apparently there is still room for improvement..

Blocking

IdSummaryMilestone
#23Make ghost MFT-records more emptyEraser 6.1/6.2
#22MFT and Directory Entries erasureEraser 6.1/6.2

Blocked by

IdSummaryMilestone
#23Make ghost MFT-records more emptyEraser 6.1/6.2

Change History

comment:1 Changed 6 years ago by Joel

  • Milestone set to Eraser 6.1/6.2

comment:2 Changed 6 years ago by Overwriter

I am a little concerned this ticket has been set for V6.1 or V6.2. Also “enhancement” should really be “defect” surly ?

Isn’t this the entire point of Eraser ? I just don’t want every wannabe forensic guy with a hex editor claiming Eraser V6 doesn’t work properly after its initial release !

A bad report by anyone reviewing Eraser V6 early on would be hard to shake off. V6 has had too much time and work on it to risk it I believe.

It would be the equivalent of an encryption program being broken on its first release, no one would ever trust it again.

Please Joel can this be addressed before a full version release of V6 ? Also ticket 54.

comment:3 Changed 5 years ago by Joel

  • Priority changed from major to critical
  • Component set to Core
Note: See TracTickets for help on using tickets.