Wipe Free Space and MFT - Remaining drive contents affected?

I

IHaveQs

New Member
I'm not sure if this belongs in support -

I just want to know about wiping the free space on a drive. Let's say it's drive that is used as storage/backup and I have many files I want to keep. I have already gone through and deleted files I don't want (by pressing delete key). So now I want to wipe the free space. Do I wipe the MFT too? If I do, will I be able to access my files that I actually want to keep? Does Eraser support MFT wiping because I didn't see it in the options but I figured it automatically did that.

What if it were the drive with the OS - wiping the MFT would render the OS unbootable, correct? So can you actually wipe free space on a disk with the main OS installed on it?

If I wipe the free space with even 1 pass pseudorandom and I don't delete the MFT - can the files be restored? I wouldn't think so. The MFT should just have the name of the file, correct? Or does the MFT actually contain enough information to restore a file regardless of how many times the actual file was overwritten? (I wouldn't think that is possible)


Thank you for taking the time to read this
 
Re: Wipe Free Space and MFT - Remaining drive contents affec

Eraser's erase features are non-destructive for data you want to keep. So although we do clean the MFT, we only erase entries which already are deleted.

MFT erasure comes as part of doing an unused space erase. There's no option to turn it off or on at this point.
 
Re: Wipe Free Space and MFT - Remaining drive contents affec

Oh ok good to know. I didn't know you could go in and delete individual MFT entries. So I'm assuming Eraser looks for the files marked for deletion and wipes them out of the MFT? Pretty neat

Thanks for the quick reply!

Is there any works in the future for showing what Eraser is erasing while it is in progress? I am sure it doesn't matter but it was just something I was thinking about.

Have a good weekend
 
Re: Wipe Free Space and MFT - Remaining drive contents affec

Actually, I just thought of something.

I have a drive on which I wanted to erase the free space but was waiting for your MFT answer first. So while I was waiting I was copying info from that drive to another just to have a backup (in case the free space wipe was destructive). So that brings me to my question:

If I copy files from one drive to another drive that was zeroed out - does the MFT from drive 1 get copied to drive 2 (I can't imagine it would do this) or does a new MFT get created on drive 2 when the files are actually placed there?

Because if the drive 1 MFT gets copied to the other drive then U was wondering if eraser would go into drive 2's MFT and try to match the entries to files marked for deletion - not find them because they were never on drive 2 - and then erase the entries in the MFT?

Does that make sense? Sorry for the strange questions
 
Wipe Free Space and MFT - drive contents affected?

The MFT is the file table on an NTFS formatted drive; on a FAT16 or FAT32 formatted drive the file table is just called the FAT. The point here is that as soon as you create a partition, format it and give it a drive letter so that Windows sees it as a drive, it already has its own file table of some sort. So when you copy the contents of one drive into another, the copied files have their own new entries in the pre-existing file table.

The file table entries as such are not copied, not least because the files will not be in the same physical location on the destination drive as they were on the source drive, and the primary purpose of a file table is to tell the system where the files are.

It is possible with specialist software to copy a whole partition from one disk to another, and then of course the file table will be copied with everything else, all in their same relative locations. But that, I think, is not what you were referring to; I'd guess that you were thinking about normal copying using Explorer or whatever.

I hope this explains things.

David
 
Re: Wipe Free Space and MFT - Remaining drive contents affec

Hi David,

Thanks for the explanation. It makes sense. I was curious if Eraser automatically takes entries out of the MFT when you do a regular erase on a file or do I have to wipe free space each time I want that info gone. I apologize if that was in an FAQ somewhere but I must have missed it.

Have a great day!
 
Re: Wipe Free Space and MFT - Remaining drive contents affec

Eraser overwrites the file table entry with random data as part of the file erase.

David
 
Re: Wipe Free Space and MFT - Remaining drive contents affec

This just made me think of something. With the conversation going on about file name obfuscation, it would be pretty cool of Eraser had the ability to create a new MFT, copy the names of existing files to it and then erase the old MFT.

I know that's some pretty low level messing around with a drive that you wouldn't want to do on every file erase, but it would solve the problem of the best way to hide the fact that a file had been removed.

Be a neat add-on maintenance feature.
 
Re: Wipe Free Space and MFT - Remaining drive contents affec

I'd really like to do that too -- but NTFS is really a very complicated file system.

It took me around 1 week to implement the directory entry cleaning for FAT since the specifications were rather readily available. In the same amount of time I did not even implement proper parsing of the NTFS MFT... which would give a hint on what scale NTFS is on :P
 
You must log in or register to reply here.
Back
Top