DELETION OF RESIDUAL FILE NAMES

[Louisaz]

It's obvious from the replies on this forum regarding file name deletion, that the MFT is a protected area on typical hard drives and that RECOVA's secure file deletion excludes the MFT-retained file names.

 

Are there programs that "defrag" the MFT? A Google search indicates there are. IF so, would the file name of a deleted file be overwritten during the defrag?

 

I understand that the program EVIDENCE ELIMINATOR will also remove all traces of the file contents -- including its MFT name. Today, I e-mailed them [EE] for confirmation. Their site suggests this is the case but doesn't specifically mention "MFT."

 

I understand that using Ccleaner with the OPTION to overwrite the deleted file may also work. Is this true? CCleaner's instructions state:

 

"Note: When CCleaner securely deletes files, it renames them with all Zs in the file name (for example, ZZZZZZZZ.ZZZ) for increased security. Since Recuva is recovering files that have already been deleted, it cannot change their names before it overwrites them."

 

Presumably, RECUVA is recovering [prior to its secure deletion] files that have been deleted by CCleaner and renamed zzzzzzz.zzz. If this is correct -- problem solved. OR is the (e.g.) temp. folder's ORIGINAL name in the MFT forever?!

 

While RECUVA's deletion protocol doesn't mess with the MFT, it seems probable that other methods may be able to delete the MFT file name.

 

I would think that RECUVA's programmers would be very interested in having the capability to include the elimination of the file name as well as its contents.

 

Comments? Suggestions?

 

Thanks,

 

Louis

[Guest MrRon]

When CCleaner securely deletes a file, it first renames the file with all Z's, it then overwrites the fragments, so this means this file is gone... forever.

When Recuva overwrites a file it is dealing with files that have already been deleted, these are different from the types of files CCleaner deletes, this means that it is not possible to rename the file first. So when Recuva overwrites a file, it cannot overwrite the filename. The only way to remove the filename of an already deleted file, is to overwrite all the unused filenames in the MFT. We are working on this feature for a future version.

 

MrRon

[Augeas]

As I understand, mainly from wasting time on Google (as anyone can do):

 

When a slot in the MFT is allocated for a file the slot remains in the MFT forever

 

The MFT never reduces in size

 

Defrags will not overwrite filenames in empty MFT slots, or move anything into them

 

New file allocations will attempt to use existing 'deleted' slots in the MFT

 

What Ron said

 

Nothing is ever deleted from a disk, just overwritten

 

Diskwashers work by filling the disk with data and the MFT with dummy file names, then deleting all they've created

 

Piriform developers know more than I do

[Louisaz]

When CCleaner securely deletes a file, it first renames the file with all Z's, it then overwrites the fragments, so this means this file is gone... forever.

When Recuva overwrites a file it is dealing with files that have already been deleted, these are different from the types of files CCleaner deletes, this means that it is not possible to rename the file first. So when Recuva overwrites a file, it cannot overwrite the filename. The only way to remove the filename of an already deleted file, is to overwrite all the unused filenames in the MFT. We are working on this feature for a future version.

 

MrRon

 

MrRon,

 

Thank you for that concise and helpful response. I get it. And I will "get" your future version that provides the file name deletion feature.

 

Louis

[YoKenny]

Is EVIDENCE ELIMINATOR still using scare tactics and false advertising to promote their application?

http://www.radsoft.net/software/reviews/ee/04.shtml

http://ee-sucks.tripod.com/ee-lies.html