Howto finish the aborted job? Want to cleanup MFT

[John2011]

Hi,

I've run eraser on one of my disks (1 TB, FAT32) to wipe out the free space (1 pass).
The program has run for more than 12 hours and ended with an error: "Insufficient system resources exist to complete the requested service"
When I checked the progress bar for the last time, something like 75% had been accomplished. I can't be sure that the free space have been entirely wiped out.

Nevertheless, 75% is enough for me as the disk is new and I'm pretty sure that the last 25% of it have never been used. But what is sure is that the FAT32 deleted entries haven't been cleaned up (Recuva or DiskDigger find thousands of deleted entries, unrecoverable but the names are there...)

I would like to be able to "finish" the job and cleanup the FAT32 deleted entries. Is there a way to accomplish this? I don't want to rerun the full multi hours wipe space just to see an error message! Maybe some kind of Pass 0?

I would also strongly suggest that you improve the logging by using some informational messages to log advancement (10%, 20%, etc) and phases start/end (Free Space wipe out, MFT cleaning etc...). The progress bar should also indicates the percentage in text.

For my first try, I'm not happy with Eraser. But, maybe that's because I don't know how to use it yet.

Thanks in advance for your help,
Regards,
John

 

[DavidHB]

Re: How to finish the aborted job? Want to clean up MFT

I haven't come across this particular error before. What OS were you running Eraser on, and how much RAM do you have? Were you using default settings for Eraser (which would mean that you were also erasing cluster tips)?

Your particular problem is that Eraser only clears the unused MFT entries when it has overwritten the free space. Also, given the way the file system works, I would not be fully confident that 75% completion has erased all sensitive data. However, the results from the file recovery programs do indicate that most if not all of the overwriting job has been done.

You need to check that no Eraser files remain on the drive, taking up free space (the method for doing this is described in the FAQ; start with the one entitled 'Common Eraser Questions'). Then, to complete the erase, you could try any of the following:

• run the erase again, but without the option to erase cluster tips;
• if you want to clear the drive completely, quick format it before running Eraser, again with cluster tips erasing disabled;
• close any running programs (especially security programs) before running Eraser;
• as an alternative to Eraser, use the drive wiping utility in Recuva's stable mate CCleaner; this has an option to clear unused MFT entries.

Finally I note that you have a 1TB drive formatted as FAT32. My instinct is that, unless there are special reasons for doing otherwise, NTFS should be used for drives that size. Also my experience (necessarily with a limited number of machines) is that Eraser 6 is not quite as robust with FAT drives as with NTFS; this may be simply because, with (probably) less use, fewer errors have been reported and corrected.

David