Overwriting files names in windows xp NTFS

  • Thread starter Thread starter Anonymous
  • Start date Start date
A

Anonymous

Guest
When i erase files one by one with eraser (i use 7 passes )

how many times the filename is really overwrited in the MFT

thank for answer
 
It doesn't depend on how many passes you use. On NT the filename is overwritten in the MFT 7 times.
 
i used getdataback for ntfs, and it found my files

Eraser does not remove the filenames. I see them all!
 
Are you still seeing the original filename when you run undelete software? On my system, Eraser overwrites the file names with random characters and sets the file creation date to 1/1/1980.

If you want to wipe these deleted MFT entries then I suggest using Directory Snoop from Briggs Software. This has the ability to purge the MFT of deleted filenames. The downside is that it costs $40.
 
Purge with Directory Snoop

Alright then I have purged with Directory Snoop however there remains a ton of files that say none and 0kb.

How do you get rid of these so a person cannot tell if something was deleted?

Thanks
 
I've noticed the same problem; All files and names/sizes are to see, after erasing( 7 passes) when running a recover program.... :(
 
There is a program, with source code available, that securely wipes the MFT. The program is located at: http://www.sysinternals.com/ntw2k/source/sdelete.shtml. While the program is not under the GPL, the source code is readily available for download and the authors of Eraser can review that to determine its algorithm and implement something similar in Eraser. With respect to the paging file, the best that can probably be done is to encrypt it using something like CryptoSwap Guerilla - which can be found by googling the filename. Regarding databases and other documents (e.g. Word temp files, etc) the best thing you can do is have an encrypted drive/virtual drive container and set directories in the respective programs to save temps on the ones on in the encrypted container. As to the registry, probably the best idea is to use a windows tune-up program that searches the registry for dead references and eliminates them. Someone also mentioned a method for rebuilding the registry in another post. Once that's done a freespace wipe would need to be done.

Needless to say, you still have a security concern in the hibernation file because anything that's in RAM is saved to that. I don't know if you can target the hibernation file after you wake the machine or if it gets automatically deleted and you would need to do a freespace wipe. My suggestion would be to turn hibernation off.
 
Eraser already does everything sdelete does, and more. When a file is erased, the filename is overwritten. BTW, did you catch this quote from the sdelete web page? It won't touch the MFT, ever.
The reason that SDelete does not securely delete file names when cleaning disk free space is that deleting them would require direct manipulation of directory structures.
Click to expand...
 
Eraser already does everything sdelete does, and more. When a file is erased, the filename is overwritten
Click to expand...

No way..like I say...
All files and names/sizes are to see, after erasing( 7 passes) when running a recover program....
Recovering the files is not possible..
But..anyway...
It worries me...
 
You must log in or register to reply here.
Back
Top