How To Erase "Ghost" File Names on FAT32

[Anonymous]

I installed Eraser on Windows 2000 with an NTFS file system, and subsequently decided to convert it to FAT32.

After doing this, I noticed that I could easily recover the filenames I had 'erased' with a freeware undelete utility, (Restoration Version 2.5.1) by using the 'Include Used Clusters...' option.

I subsequently installed Windows 2000 on a second partition, and ran Eraser from there on the first drive and had it erase the free space and the cluster tips. To my surprise all those 'ghost filenames' appear to be gone.

I have no idea why running Eraser from a seperate partition makes any difference, but it seems to. This is also a good way to make sure the paging file is completely erased.

It only takes a little over 1 gig partition to do a basic install of windows 2000, and Eraser seems to work alot better if the partition you are running it on is not active.

mugz839

 

[Anonymous]

NTFS file system ... decided to convert it to FAT32 ... After doing this, I noticed that I could easily recover the filenames

The information you were able to recover was probably stored in one of the hidden internal files kept by NTFS, such as the journal file. Converting the file system to FAT32 quite likely left this information in the unused space on the drive where you found it.

I subsequently installed Windows 2000 on a second partition

So in other words, you have a copy of Windows on both partitions, and you can choose which one to run?

and ran Eraser from there on the first drive ... To my surprise all those 'ghost filenames' appear to be gone.

There are two reasons for this: (1) The operating system you were running resides on the second partition, so the files used by the operating system you have installed on the first partition are not locked, allowing Eraser to access them freely. (2) The FAT32 file system is very simple and has a known format, so it can be easily cleaned, while the NTFS is a journaled file system with a proprietary format making it nearly impossible to completely erase unwanted data.

What I am saying is that it may very well be impossible for a user space application to completely remove data from an NTFS partition, because it cannot control where each piece gets (temporarily) stored during standard disk operations. Therefore, I suggest using encryption instead of relying on overwriting if you are using the NTFS file system. :idea:

Oh, and this applies to all journaled file systems regardless of the operating system, and even if the file system format is known. Overwriting works no better on XFS, ext3 etc. than it does on NTFS.

I have no idea why running Eraser from a seperate partition makes any difference ... Eraser seems to work alot better if the partition you are running it on is not active

If I understood you correctly, this has nothing to do with the location of the Eraser executable, but rather the location of the active operating system. More importantly, the conversion to FAT32 allowed Eraser to clean the file system better.

If you hadn't converted the file system and still had NTFS on the first partition, booting to the operating system on the second partition and then running Eraser might still not have resulted in an equally clean partition as NTFS is notoriously difficult to clean.

This is also a good way to make sure the paging file is completely erased.

You are absolutely correct. The paging file can be erased only if the the operating system using it is not running.

 

[Anonymous]

Re previous post:

Yes, I used partition magic to creat a 3gb partition at the end of my drive and went through the Windows 2000 setup and installed a second copy on this small partition. It's quite easy to do because after you choose to install, it lets you choose the partition you want to install it on. All I plan to use this second partion for is sort of an 'emergencny' recovery tool in case my primary wont boot, and to use Eraser.

I agree with you on NTFS vs FAT32 - that's why I decided to ditch NTFS.

On a side note, does anyone know how to clean the NTUSER.DAT file? I notice that file contains filenames and records of software long after they are deleted. Eventually, things do seem to work there way out of this file, but it takes quite a while. I have tried every registry editing tool I can find and while many claim to be able to edit/view the file when it is not active, none of them show these filenames I can see simply by opening it with notepad.

mugz