Does Eraser really overwrite r-clicked fragmented files?

M

manu

New Member
I need some reassurance that Eraser really overwrites a fragmented file when invoked by a right-click. Consider this situation. File A is fragmented into 2 parts. The first part is immediately followed on the disk by file B. Then file B is deleted. If I now right click on file A and invoke Eraser, will Eraser really overwrite both fragments? If Eraser simply overwrites file A with another file of the same size, the OS might overwrite only the first fragment of file A, and all or part of the now-deleted file B. The second fragment of file A might be left un-overwritten.

Does Eraser really handle this situation. For all versions of Windows?

I have searched the internet for info on this situation, but found nothing. Does Windows really provide any functions for Eraser to use to handle this situation? I have not found any. I also cannot find any way to create this situation and test if Eraser does work.

I realize that if I delete file A and then use Eraser to erase the entire disk, A will be overwritten. But that is not what I am asking.

Thanks.
 
Hi manu

As Carver said you should be ok. The only time there may be an issue is when using flash drives due to their “wear levelling” technology.

However wiping the entire free space of a flash drive will address the situation. :wink:
 
Thanks for the replies. I feel somewhat reassured. But for my benefit, and for the benefit of others that read this forum, I need to ask: how do you know for sure? I would be convinced if someone posted a way to create that fragmented situation and then I tested Eraser on it. Or if someone could post the *name* of a Windows function that Eraser might use to handle the situation. Or is someone could point me to a Microsoft knowledge base article that confirms that Windows will overwrite both fragments of file A in that situation. Because I have searched for those, I realize that they are hard to find. So, I realize I am asking for a lot.

I should have mentioned in my first post that I am referring to a regular hard drive, not a flash drive.

Thanks in advance.
 
I understand your question better now. I think it would be clearer if you called them file A1, A2 and file B.

A1 and A2 are two parts of the same file but fragmented. File B just happens to be behind file A1.

So in your situation when file B has already been deleted then you choose to erase file A only file A1 and file A2 will be overwritten.

The reason Eraser should work is because the location of file A1 and A2 are in the MFT. Master File Table……I think ! :lol:
 
Thanks for the help, but I am not convinced.

By testing, I have found that, by default in Windows XP, the MFT record size is 1024 bytes and the cluster size is 4096 bytes. So, no file fragment can be in the MFT unless its size + the size of all it attributes < 1024 bytes. Also, Windows does not move any file which is non-resident in the MFT into the MFT unless it has size 0. So, neither fragment of file A could be in the MFT, unless (which seems unlikely) one fragment has size 0.

Also, if the disk is formatted FAT32 instead of NTFS, it has no MFT.

Here is a possible workaround for the problem of erasing a fragmented file. Use the Windows command-line function contig.exe to test if the file is fragmented. If not, Eraser can be used to erase it. If it is fragmented, delete it and then use Eraser to erase all the free space on the drive. But that might take days for a 250 GB hard disk. The same approach can be used to erase one folder, because contig will accept a folder name as its argument.
 
Hi manu

I think you misunderstood my reply, I wasn’t clear enough.

I said the “location” of file A1 and A2 are in the MFT.

Location meaning location details, as in where to find the fragments not the actual file itself.

If the disk is FAT32 then the files “location” is within the File Allocation Table.

I am not Erasers developer and so I am just trying to help answer your questions. Joel is usually the one to ask about these things but he has been away for some time recently but I am sure he will be able to explain it better than me.

I appreciate you are not convinced but think of it a different way, if the files “location” details were not in the MFT or FAT how would windows open a defragmented file ?
 
Hi.

Well, I did figure out a way to test if Eraser 5.82 does overwrite right-clicked fragmented files. I filled up a hard disk. I deleted 2 cluster-sized files separated from one another by 10 clusters or so. I wrote a file of size = 2 x clustersize. It went into those 2 clusters. I deleted the files in the 10 clusters in between. I ran Eraser by right-clicking on the file. AND ERASER DID OVERWRITE THE 2 FRAGMENTS!

I did the test both on FAT32 and NTFS using Windows XP Professional. Eraser worked on both.

So, now I am convinced. Sorry I doubted you, Eraser.
 
By the way, I learned something else, too. I used the same fragmented setup with the 10 empty clusters between the fragments. I found that simply using Window XP Professional to overwrite the fragmented file with another file of the same size (= 2x cluster size) will not overwrite both fragments. The 2nd cluster of the file used to overwrite goes into the first empty cluster after the first fragment. So, simply using Windows to copy over a fragmented file will NOT overwrite all fragments.
 
Hi manu

I ran Eraser by right-clicking on the file. AND ERASER DID OVERWRITE THE 2 FRAGMENTS!

I did the test both on FAT32 and NTFS using Windows XP Professional. Eraser worked on both.
Click to expand...

I am pleased you took the time to test Eraser. In fact Eraser V6 is under production and I would be grateful if you would test that release which should be due around Christmas time.

Are you interested ?
 
You must log in or register to reply here.
Back
Top