erase cluster tips during unused disk cleaning? i need help!

[voidshot]

to begin with, i would like to pay my compliments and respect to the makers of eraser, its a very good program, although it takes some time and reading to figure it out good. im sure eraser will be a huge app shreder in the future as it progresses trough trial an error.

so far i have read all the faq and im still not sure about something, i want to erase my unused space, when i add a new task on the schedule windows it gives me an option to disable or able "erase cluster tips", what should i choose? whats more safe?

so far i havent done a full erase of my unused space do to uncertainties of what is best.

when i try to wipe my unused space with the "erase cluster tips" enabled i noticed that the process of deletion is extremely slow..
And when i double click on the running task to see the remaining time it says "unknown" time... so i eventually stop the process since it takes so long.

but when ever i test run to erase my unused space with the "erase cluster tips" unable'd the process seems to run smoothly and even displays the remaining time of the task..

my question:
1.if i disabled the "erase cluster tips" option, do my files on my unused space get safely shred'ed/deleted even though i didnt have the "cluster tips" enabled?

2.whats more safe when erasing unused space? enabling "erase cluster tips" or disabling it?

3.whats the benefit of having "erase cluster tips" enabled?



4.ps: i also noticed that when i double click on the task it shows which items are being managed, im scare because it shows items that are not in the unused space but rather on my desktop and local disk (C.. is it erasing those files too?
and when i try to run it using the "erase cluster tips" enabled i get two problems, the time displayed of the running task is "unknown and the status bar eventually says "querying status", is all this normal?

please someone who knows write back as soon as you can,
i dont dare to erase my unused space until i get this concerns reassured.



2nd ps: i got zipped files in my unused space, will the zipped files be able to get randomly coded as well when i run erase unused space?

 

[DavidHB]

if I disabled the "erase cluster tips" option, do my files on my unused space get safely shredded/deleted even though I didn't have the "cluster tips" enabled?

Yes. Everything in free space, including previously deleted files, is overwritten. That's how the program works.

what's more safe when erasing unused space? enabling "erase cluster tips" or disabling it?

Enabling the option is, in theory, safer, but the advantage may be quite small, and, because of Windows security issues, you may get quite a lot of errors and/or notifications, particularly if you are trying to wipe free space on the system (C:\) drive. If Eraser encounters a protected system file, it cannot erase the cluster tip of that file, and will generate a message to that effect. On a system drive, that may mean that you get thousands of messages in the log (!), which is normal (!).

what's the benefit of having "erase cluster tips" enabled?

A more complete wipe. At the end of virtually every file (that is, files that have not been and are not being deleted) there is a small amount of free space which is not overwritten by the file, and which could possibly (but usually does not) contain recoverable sensitive data. This is the cluster tip. Obviously, if you can wipe the cluster tips as well as free space, you have a better chance of erasing everything that is sensitive.

However, in the circumstances I have described, the only way to be absolutely sure with a system drive is to make a full system backup, remove the drive from the machine, attach it as an external drive to another computer running Eraser, format then erase the drive, reinstall the drive, then use a boot disk with restore software to restore the system backup. This is not a process for the faint hearted, and it is absolutely not recommended unless you are fully confident in what you are doing and understand the risks. As you are not confident, this is certainly not for you, so (like most of us) you have to give up on the idea that you can achieve absolute security. In practice, the level of security achieved by a simple free space wipe (without cluster tips) is entirely adequate for most people.

Assuming that you are an ordinary user with a home or small office computer, I would in the first instance do a free space wipe without erasing the cluster tips. Then use a file recovery program such as Recuva to scan the disk for deleted and recoverable files. You will find a lot, but most of them will be the rubbish files Eraser uses to wipe the free space. It's only if you find files that should not be recoverable that you should report the problem here.

I also noticed that when i double click on the task it shows which items are being managed, im scare because it shows items that are not in the unused space but rather on my desktop and local disk (C.. is it erasing those files too?

If a task shows files you want to keep, delete it immediately. When a task is run, files added to it will be erased. Permanently. That is the very purpose of Eraser.

If you don't know how to set up a task to erase a file, read the manual carefully. If you are not sure what Eraser will do in a particular task, don't run it.

If you simply want to wipe free space, start a new task (Ctrl+N), click on the Add Data button, and in the window that opens, click on the radio button for 'Unused disk space', then, if necessary, select the drive. If you are following my advice, un-tick the option to erase cluster tips. Press OK, check that the task is set to run manually, then OK again. To run the task, right-click on it in the task pane and select 'Run Now', then go away for a long time (typically several hours with a large hard drive), and wait for the task to complete.

... and when i try to run it using the "erase cluster tips" enabled i get two problems, the time displayed of the running task is "unknown and the status bar eventually says "querying status", is all this normal?

No. What version of Eraser are you using on what OS? For you, I would recommend the current stable version (6.0.7). If that's not what you are running, uninstall Eraser, and download and install 6.0.7. If it is what you are running, please try running a 'wipe free space' without wiping cluster tips as I have described, then report any problems here in as much detail as possible.

i got zipped files in my unused space, will the zipped files be able to get randomly coded as well when i run erase unused space?

Yes.

Again, given your concerns, please do read the manual, and also the FAQ (link below).

David

 

[voidshot]

thank you so much for the quick response, as of last night, i began to do a unused space wipe with the "erase cluster tips" enabled, i still got the same message when i try to view the task progress( time="unknown"/ status= querying status). I chose to ignore this and left it running while i slept, i woke 3 hours later to find that the messages were gone and the "time" provided me with a solid time estimate and the "status" showed the files that were currently under process,
I'm running windows 7 64x with eraser 6.0.7...

when performing a unused space wipe with "eraser cluster tips" enabled the key to a successful progress is to simply wait, the the "unknown" and "querying status" will eventually disappear..

after the process was finished i did get a load of error on the task log, which i know is normal.
so i proceeded with another unused space wipe, but this time with the "erase cluster tips" disabled.
the process was with dod 1 pass(same as before) and at the end of the process i had zero error messages on my task log.. so mission success in that part.

so far the only files i have found that are recoverable are system files that are protected(both from my computer and other programs i have downloaded).


one question
1.when eraser erases a file set on 'file erasure' does it send it to C: drive partition NTFS.
and when a unused space wipe is performed on C: drive is able to erase more then just NTFS content? how about the FAT files, when i performed a complete file recovery the files i was able to find recoverable were mostly FAT files, from system setting and tools i have previously deleted and what not..

 

[DavidHB]

It sounds as though Eraser is working as it should for you, albeit with some oddities (well, things I'm not aware of on my machines) which I hope we can ignore. They are probably to do with other things going on in your system. One thing that often makes free space wipe a bit faster is to temporarily disable your antivirus program while the wipe is running. If you are worried about this, also physically disconnect from the internet while you have no antivirus running.

It also sounds as though Eraser works more comfortably when not erasing cluster tips as part of a wipe. That is my experience also. And, in my view, that does not unduly compromise most people's security.

Now your other question. Before I answer it, I want to be sure you know that Eraser has four types of erasing operation:

• erasing a file;
• erasing the contents of a folder and, optionally, the folder itself;
• wiping the free space (that is the space not allocated to files) on a drive, and, optionally, cluster tips as previously described;
• erasing the contents of the Windows Recycle Bin

With the 3 tasks I have described as 'erasing', Eraser overwrites the only space allocated to the erased files in the Master File Table; depending on the way the drive is formatted it also does other things to remove traces of these files, but I won't complicate the answer by describing these other actions. Eraser (at least the version you are using) does not move files. Wiping free space is a little different in that all unallocated space is wiped irrespective of where any deleted files are; actually Eraser does not know or care whether or not the space it is wiping contains traces of deleted files.

You seem to be confused about the meanings of NTFS and FAT. Simply put, they are different file system formats used by Windows. Early versions of Windows used FAT; from XP on, the standard (for hard drives at least) has been NTFS. Without going into details, NTFS is is much more complex and capable file system than FAT. Your Windows 7 system will use NTFS. However, if Windows 7 was installed on a hard drive which had previously been FAT formatted and was then only quick formatted to NTFS, I could imagine that some file recovery programs might find traces of deleted files from the previous installation, but I would expect an Eraser free space wipe to remove these traces. Whether that idea is relevant in your case, I cannot say; it doesn't sound as though you have identified any major security issues. As a matter of interest, was your Windows 7 installed on a new drive or one that had previously been used for an earlier version of Windows? Also, do you have only Drive C: in your machine, or are there other drives also?

David

 

[voidshot]

when i go to computer to view my drives
i have C: drive and D: drive(for recover files)
only this two drives show

but when i use Easeus system recovery program it automatically searches for drives and it shows 2 more drives that are not shown in the "COMPUTER" window of explorer
this is the list of drives that it detects
C: (NTFS) 284.61 GB
D: RECOVERY (NTFS) 13.18 GB
*:SYSTEM (NTFS) 199.00 MB
*:HP_TOOLS (FAT32) 103.34 MB

And im not sure if my windows 7 had a previous operating sytem. but i might suspect so,
because when i bought this computer it was in sales, which usually means their are computer that previously had something wrong with them and was fixed/formated etc and put back into the shelf for a lower "special" prize. i bought my pc at fries..

also, im noticing for sure FAT files are not being deleted from my unused space, perhaps it is as you mentioned, perhaps their are files from an older operating system before i bought my windows 7 and eraser doesn't recognize them as unused space files?
i think the files from *:HP_tools(FAT32) are the ones not being deleted
:::anyway where does does those two extra drives come from? and why dont they appear on my windows explorer "COMPUTER"?


ps: is the current development of the free eraser just a beta process that will lead up to a final stable software that will be sold?

 

[DavidHB]

:::anyway where does does those two extra drives come from? and why dont they appear on my windows explorer "COMPUTER"?

Because they are not meant to; they are deliberately formatted in a way which Windows will not recognise. This is the normal method these days of providing System Recovery, particularly on laptops. Do not access, change or delete these invisible partitions; they are the means by which by which you recover the machine to factory default condition if you need to. Also, as it is Windows based, Eraser will not touch these partitions, which is a good thing.

The existence of the hidden partitions is not a security problem, because no user information is stored in them.

Do read the documentation which came with your machine. If there isn't any (by no means uncommon, these days), go on (presumably) HP's website and find the documentation for your model. It would do you no harm to download and save a spare set of drivers at the same time.

is the current development of the free eraser just a beta process that will lead up to a final stable software that will be sold?

Eraser 6.0.7 is not a beta; it is a (relatively) stable release. Eraser is going through a period of transition, during which it is being progressively re-developed to co-exist better with the newer versions of Windows. Eraser is and always has been open source software (i.e. free), but you can donate towards the cost of development if you wish.

David

 

[Joel]

I also noticed that when i double click on the task it shows which items are being managed, im scare because it shows items that are not in the unused space but rather on my desktop and local disk (C.. is it erasing those files too?

If a task shows files you want to keep, delete it immediately. When a task is run, files added to it will be erased. Permanently. That is the very purpose of Eraser.

That sounds like the cluster tips of files being erased. The files there are the files whose cluster tips are being erased.

one question
1.when eraser erases a file set on 'file erasure' does it send it to C: drive partition NTFS.
and when a unused space wipe is performed on C: drive is able to erase more then just NTFS content? how about the FAT files, when i performed a complete file recovery the files i was able to find recoverable were mostly FAT files, from system setting and tools i have previously deleted and what not..

The FAT files are inconsequential. Upon reformatting of the drive to NTFS, the old FAT files become NTFS free space, which will be erased by the unused space erasure.