Process question - erase unused space option - full disk.

T

tyndal

New Member
I have enjoyed using eraser and other security tools for a while. I do both secure data removal as well as disaster recovery.

Now I have also run into with various unerase unused space processing, it taking up 100% of the disk space and forcing the system to self destruct the restore points as an example. (in windows)

Many users have the issue of the file on completion, holding a ghost memory area, due to machine resource OS.

If I want to say clean unused space on drive c: Would it be effective to instead of running it from windows on drive C:

load a ram based OS? Like hirens CD and launch the Mini XP option.
Eraser will load in the ram memory and work.
in this case I would target the hard drive (no longer the OS) and it would erase unused space but would no longer have an issue with space. (due to the program running in RAM memory and not HD space.

I assume it would see the C: as a data drive and all files would be ignored and it would no longer fight for drive space, error out, remove recovery points or leave a trace from the locked erase files.

Has this been tested? Is it a viable solution? Would a mini boot system be a way to resolve the erase unused space issues.

Thanks!
 
Re: Process question - erase unused space option - full disk

The problem does not necessarily occur on Drive C:, though, from anecdotal evidence in forum posts and my own experience, that is where it is most likely to occur. Sometimes, running the erase on Drive C: with the option to erase cluster tips disabled will work. Typically, I do not erase cluster tips on Drive C:, as there are so many protected files that the security gained is not worth the additional running time.

Running from another drive as you suggest would probably not work, because the issue is the somewhat unpredictable way that Windows triggers the low disk space warning from the target drive and then shuts down Eraser; that would, I believe happen wherever Eraser is being run from. While the issue is known, the work on identifying the precise mechanism that Joel undertook a few months back showed that there were several different contributory causes. Joel made some changes to the 6.1 development builds, but I am unsure whether these changes were ported back to the 6.0 fork; I suspect that some at least were not. So the first recommendation is to uninstall version 6.08, and install the latest 6.1 build (2284).

The point about the free space erase removing restore points is an interesting one. I haven't tested; did you find that a free space erase removed all restore points (which would be surprising), or just older ones? There are swings and roundabouts where restore points are concerned, because they contain shadow copies of deleted files and so are a pretty major privacy/security hazard. My own practice is to enable System Restore only for Drive C:, and to use CCleaner regularly to remove old restore points.

David
 
Re: Process question - erase unused space option - full disk

Yes I have tested it over the years.

At least in win XP what happens when using erase unused space on a drive containing the OS, XP as an emergency measure..

tries to help you from a crash by dumping whatever it decides it can. When you get the disk space is running low message it is helping you by starting to remove files. Included in this is the system recovery files.

In effect it helps by removing the emergency backout plan :) *nice.. *

why I asked about running it in a seperate enviroment is because I suspect, like using eraser to clean an external drive..
drive space would no longer be an issue, because the OS is not concerned about the area hitting 100%.

Since the program is running in effect in a seperate enviroment.

I will test it monday on a few of my test machines.

I wondered if it would be a more effective clean because if you boot to for example mini-xp from the CD drive and are using ram space, in effect no files are locked on the main OS drive. for all intent it is just a data drive.

I asked if it was tested, because if someone posted in the past about issues involved, it would be great to know about.

Thanks for your reply!
 
Re: Process question - erase unused space option - full disk

Testing update.

I ran eraser on 2 seperate xp pro machines.
1) Machine 1 - as a basic clean up
2) Machine 2 - I put in a large number of files and deleted them.
3) I made a system restore point and verified 5 other points available.
my first issue was using hirens and mini xp the install wanted to have windows installer 3.0 and
due to this. both 5.86 and 6.# versions failed to even load in ram space environments.

I downgraded to eraser 5.7. This does not require win installer and loads in ram space without issue.

I booted into mini xp (now my C drive was for all intents a data drive and did a erase unused space)

I selected all check marks including cluster space and ran eraser.
The erase ran without issue and when I rebooted to normal XP on drive C: (the OS) it was functioning without issue
All checkpoints were intact, and running a data recovery disk, no files were present to undelete/restore.

There was no disk space error and no crash of the program.
 
Re: Process question - erase unused space option - full disk

Process for others in case they want to test themselves.

download hirens onto a CD
Pull eraser 5.7 onto a thumb drive (zipped package is fine)
boot to CD (choose mini xp option)

connect the thumb drive
drive B is the ram drive (open your thumb drive and move eraser5.7 to b: ram drive)
install eraser in place in the ram drive
once installed go to the drive manager
choose the OS drive (C: for example)
right click and choose erase unused space.

** NOTE - Because you are installing eraser to a ram drive, you will have to re-install after every reboot of the machine. **
 
Re: Process question - erase unused space option - full disk

This is not unexpected, as you are basically making a "system" drive appear to be a "data" one.

The use of an OS (Hiren's boot CD) other than Windows makes the System Restore points (technically, those are Volume Shadow Copies) indistinguishable from user data to the OS and as such the OS will not remove the data as the disk usage approaches disk capacity.

Also, do note that running Eraser on platforms other than Windows may mean that the erasure may not work. Windows NT has a particular kernel feature (object reuse) which Eraser depends on for functioning correctly. The Linux NTFS driver may not have the same guarantee, effectively nullifying the usefulness of Eraser.
 
You must log in or register to reply here.
Back
Top