File overwrite information


New Member
If a standard windows delete was performed on a disk and then a free space wipe performed with eraser on that same disk, would data forensics still show that the individual file overwrites took place without showing any of the data associated with that overwrite?
Assuming that free space was successfully completed, the original file data and the associated directory entries would have been overwritten and would not be recoverable. However the files used by Eraser to wipe the free space would be detectable and recoverable, though the only data that they would reveal is that the free space had been wiped. Use of the plausible deniability feature in Eraser would make this more difficult, though not necessarily impossible.

However that is only part of the story. Eraser, as you would expect, erases only space and directory entries marked as unused. But file systems (especially NTFS) and the OS put whole or part copies of files in such places as Restore Points (shadow copies), journal and MFT entries and the page file, and these are not marked as unused; file recovery programs can often reconstruct deleted files from these sources. As this behaviour is inherent in Windows, there is not much users can do to prevent it, though I have posted details of some palliatives elsewhere on the forum.

I know there are ways to clear these hidden areas on hard disks---but why? Under normal circumstances, no user data is written to these areas; most of the content is system/hardware-related information placed by manufacturers, correct?