Eraser and File Slack/Ram Slack

W

wjymhzjlagg

New Member
Hi,

My question concerns eraser and file slack.

If you have a text file and you delete a small part of the contents in a text editor, would any remnant remain in the slack of the file and if so, would this be removed by eraser.

Would copying the file to a new location also remove the remnant if any.

For a given file, would there be any data not viewable in a text editor that eraser or a copy would not remove.

I'm basically wondering whether I can copy my text files to a new hard disk or whether I need to copy the contents only, e.g. create a new empty file, open the existing file and copy and paste the text

Thanks
 
My understanding is that when you edit a file, the whole file is re-saved (which may of course mean that the whole of the old version resides in free space). If the file is very small, the whole of it may be saved in the MFT entry; then, I presume, it would at least partially overwrite the previous contents, but some of them might remain in the unused part of the entry.

Again as far as I know, when you copy a file, nothing is copied apart from its recorded extent; I'm as near sure as I can be that no previously deleted material will be copied. In any case, such material would not be accessible to the file system or file recovery programs. It would take a very determined and technically capable opponent to recover it, even if it does exist.

David
 
Thanks for your reply.

Would writing a perl/python script to read character by character a text file and then write each character to a new file ensure for certain no slack was copied?

IF this were changed to read each byte rather than a character, still ensure no slack was copied.


Thanks
 
Well, if you use streams as the normal method of working with files, the stream process will stop when the end (EOF) is encountered. Slack is not copied. Of course there will be slack (= a cluster tip) in the receiving location, but that will not be the same as the slack in the sending location. If you are worried about cluster tips, Eraser can wipe all those it can access as part of a free space erase before you do any copying. The cluster tips Eraser cannot access are typically those of protected system files, so the limitation is unlikely to be of concern to most users.

David
 
You must log in or register to reply here.
Back
Top