Erasing free space and file recovery

D

DoctorM

New Member
I'm sorry if this has been asked and answered, but I'm sort of new to this and I'm not sure of the proper terms to search for.

After doing a free space erasing (in this particular instance my older FAT32 drive), I can still load file recover software and see a list of files that were previously deleted (via normal deleting, not by Eraser).

Even though the actually data appears to be unrecoverable, I'm not comfortable with the names of files deleted as long as 3 years ago still be accessible.

Is there a way to clear this information?
If not with Eraser, then with some other program?
 
Did the erase complete normally? First check that the erasing process has not 'reduced' the amount of free space on the drive. If it has, go to the FAQ (link below) for information on how to remove the temporary files left behind by Eraser. If this has happened, the MFT will not have been cleared and this will explain your problem.

I also assume that the free space erase ran for a considerable period of time. If it didn't, or there is any other sign that it didn't complete normally, look for an entry in the Task Log.

If the drive is a non-system drive, backing up the data, doing a quick format, then a free space erase before restoring the data will not only clear everything, but will de-fragment the drive as well.

David
 
Before you do what David suggests, did you do an Unused Space erase?
 
Joel said:
Before you do what David suggests, did you do an Unused Space erase?
Click to expand...
Unused space erase, check.
Run for a good long time, check.
Completed correctly? Not sure.

Garbage files were added to the root directory with random characters, but I thought I read somewhere this is typical (and to be fixed later).

Edit: To be clear, this drive is FAT32, so it doesn't have an MFT. (I think I've got that right.)
 
Okay, how about what David says?

Pardon me, I've been reading posts way too quickly for my own good lately...
 
I'm not sure what bit you are referring to about 'what David said'.
It is, unfortunately, my system drive, so I cannot remove the data and reformat.
Still, I would hope that there is software that can do that more conveniently.

Edit: Tried the same process with Eraser 5 and received: Error: Failed to clean directory entries from drive C:\, there was something not quite right with the file system. You may want to run ScanDisk.

Hmmm.
 
Hmm, you may like to convert your system drive to NTFS instead. Eraser needs to lock the drive it is erasing to clear the old FAT/Directory/MFT entries. System drives cannot be locked so it does fail.

Use the "convert" command:

Code: 
convert C: /FS:NTFS
 
Joel said:
Hmm, you may like to convert your system drive to NTFS instead. Eraser needs to lock the drive it is erasing to clear the old FAT/Directory/MFT entries. System drives cannot be locked so it does fail.

Use the "convert" command:

Code: 
convert C: /FS:NTFS
Click to expand...

I keep a second NTFS drive for media and files larger than 4gb.
FAT32 is more flexible and generally better for other purposes, so I have no intention of converting my main drive.

I guess I'll have to look around for software that can erase before booting to the desktop. That'd be a nice feature in general.
 
With XP and later, NTFS is the 'native' file system. I agree that FAT (most usually FAT32) has some advantages for non-system drives under certain circumstances, but NTFS is likely to be the better bet for a system drive. At one time, if you had multiple OSs, NTFS was a real pain, but Linux in particular can now read and write to NTFS partitions.

David
 
I'm sorry if this has been asked and answered, but I'm sort of new to this and I'm not sure of the proper terms to search for.

After doing a free space erasing (in this particular instance my older FAT32 drive), I can still load file recover software and see a list of files that were previously deleted (via normal deleting, not by Eraser).

Even though the actually data appears to be unrecoverable, I'm not comfortable with the names of files deleted as long as 3 years ago still be accessible.

Is there a way to clear this information?
If not with Eraser, then with some other program?
Click to expand...

I found this at http://technet.microsoft.com/en-us/sysi ... 97443.aspx regarding SDelete, which appears to be a smaller scale but similar application.

The reason that SDelete does not securely delete file names when cleaning disk free space is that deleting them would require direct manipulation of directory structures. Directory structures can have free space containing deleted file names, but the free directory space is not available for allocation to other files. Hence, SDelete has no way of allocating this free space so that it can securely overwrite it.
Click to expand...

Seems to imply there is a file system limitation that can prevent this data from being erased?
 
markf said:
.... SDelete, which appears to be a smaller scale but similar application.
Click to expand...
It is a console (i.e. command line) utility with a powerful but somewhat unfriendly set of parameters. Useful for the technically savvy, but not what most Eraser users are looking for.

markf said:
Seems to imply there is a file system limitation that can prevent this data from being erased?
Click to expand...
There certainly are limitations. However, the jury is still out as to whether they can be overcome. Joel has been doing experimental work on low-level access to the NTFS file system; it will be interesting to know the outcome.

David
 
However, the jury is still out as to whether they can be overcome. Joel has been doing experimental work on low-level access to the NTFS file system; it will be interesting to know the outcome.
Click to expand...

Certainly would be interested to see the outcome.
 
You must log in or register to reply here.
Back
Top