Possible to just erase cluster tips and MFT

R

rjo98

Member
I know when you schedule a free disk space eraser you can have it do the cluster tips, and at the end of a free disk space wipe it always does the MFT at the end (I think erasing records of files that no longer exist, is that correct?)

But say I wanted to do only the cluster tips and the MFT part, if I dont have time to run a full free disk space eraser. Is that possible or will be possible in the future? With drives being so large, doing all three at once is incredibly time consuming, so being able to break them up might help. I know there are flaws to this method if you want a total free space wipe, since things could move around on the hard drive in between what you do, but I still think it might be worthwhile.
 
Good observation. This was supposed to be planned for 6.2; I believe there should already be a ticket for this, otherwise feel free do make one.

Thanks!
 
While I am glad that Joel wishes to oblige, I am uncertain as to whether this function would, in most circumstances, add to user security unless the free space is also wiped. It would be unfortunate to give users the wrong impression.

David
 
Erasing the MFT only serves as a decoy as that will require software like Recuva to do a deep scan to find deleted files. In addition, as the extent information associated with the file no longer exists, it is thus no longer possible to reconstruct a file should it be fragmented.

The previous suggestion IIRC would be to do the MFT erase before the free space erase which probably should do the same thing (I think it was you who raised it, can't really remember clearly.)
 
I see the point. Clearly, there are circumstances in which erasing just the unused MFT entries would make an opponent's task harder (if only because file recovery would then take hours rather than minutes per drive). However, it is still my view that if the function were implemented, users would need to be fully briefed on its limitations.

I do think that the idea of erasing the MFT entries first arose in one of our conversations, though it may have been you rather than I who suggested it. If I recall correctly, the idea of that was to leave the drive in a more secure state if a free space wipe crashed when the disk became full. As forum posts suggest that that still happens on occasion, the change might still be worth making, if you continue to use the current method of erasing free space.

David
 
Yeah, I guess my request of say only erasing the MFT would be more "security by obscurity" by making recovery efforts harder than geared toward more total security. Guess I was thinking more if there was a file or something that stayed resident in the MFT that contained confidental info, the only way I know of to erase it now is to let an entire hard drive's free space erase, then it will do the MFT once that completes. Was just thinking of how to best just get those files resident in the MFT that were deleted through the OS.
 
Indeed. I now see the point. :idea:

David
 
You must log in or register to reply here.
Back
Top