Jump to content

Return to Piriform.com

Photo

Using the "Wipe Free MFT Space" Option in CCleaner after secure file deletion with Recuva


  • Please log in to reply
5 replies to this topic

#1 OFFLINE Greger

Greger

    Member

  • Members
  • PipPip
  • 17 posts

Posted 12 July 2012 - 12:53 AM

Whenever I've deleted a few files on my hard drive(s), I usually use Recuva to search them up and write them over one by one until they read "Unrecoverable". However, the file names remain intact, and Recuva does not have an option to wipe the free MFT space, which to my understanding stores the file names of these deleted files, yes? So, as an effect of this I then usually use CCleaner to get rid of these file names (with everyting checked in settings, i.e. Secure file deletion, Wipe Free Space, Wipe MFT Free Space etc). However, as this takes a rather long time just so that I can get rid of the file names, and as I've already used Recuva to securely delete the files, is it enough to simply check the Wipe MFT Free Space box in CCleaner, instead of wiping all free space with Wipe Free Space as well? And is it secure enough, i.e. will these file names be securely deleted?

Also, and with the above mentioned in mind, have I understood it right that I can use CCleaner to individually delete and wipe/securely delete files and their file names of not yet deleted files? I.e., instead of deleting the files, then using Recuva to securely delete them and efter a while, wipe all free space (including MFT) with CCleaner? If that's so it sounds like a pretty faster method than my current one.

#2 OFFLINE Augeas

Augeas

    Moderator

  • Moderators
  • 3,087 posts
  • Gender:Not Telling
  • Location:Where Stuff is made, UK

Posted 12 July 2012 - 02:09 AM

Deleting files and then using Recuva to find and overwrite them is laborious and unreliable, as the MFT entry can quickly get reused (by opening Recuva, for instance), leaving the file data untouched on the disk. Your current method of overwriting files is even more laborious.

I would use CC Wipe Free Space and Wipe MFT once, to give you a clean disk. Then use CC secure file deletion set to one pass. This will overwrite the file names and data when you run CC.

This won't do anything to files deleted outside of CC, so perhaps you could delete files to the recycler and then use CC to overwrite that.

#3 OFFLINE Greger

Greger

    Member

  • Members
  • PipPip
  • 17 posts

Posted 12 July 2012 - 01:42 PM

Ok, I'm not sure I'm following you on this one as I'm not too familiar with all options available in CCleaner. But I've read a few older posts by you and others, so let's see if I've got the hang of it.

CCleaner won't securely delete files that have already been deleted (i.e., shft+delete deleted or simply emptied from the recycler). To securely delete these files, then, you have to use either Recuva or CCleaner's Wipe Free Space (and Wipe MFT Free Space if you want to have the file names wiped and renamed). Am I right?

However, if you have not yet deleted a file and want it securely deleted, wiped from MFT and renamed - you can do so by deleting it via CCleaner. Am I right? My question is then, do you do this by choosing the include alternative in options, or how do you do it?

Also, I'm not really sure what this is supposed to mean:

"CCleaner can only securely delete files which have not yet been deleted from the Recycle Bin. If you have already delete files insecurely (for example, using Windows Explorer), you can delete them securely using Recuva."

But if I run a wipe free space (with everything else checked, including the Secure file deletion (Slower) option) - won't these already deleted files become securely deleted. Or is that just a terminology thing - where these already deleted but not securely deleted files will become wiped?

#4 OFFLINE Augeas

Augeas

    Moderator

  • Moderators
  • 3,087 posts
  • Gender:Not Telling
  • Location:Where Stuff is made, UK

Posted 12 July 2012 - 02:06 PM

CCleaner won't securely delete files that have already been deleted (i.e., shft+delete deleted or simply emptied from the recycler). To securely delete these files, then, you have to use either Recuva or CCleaner's Wipe Free Space (and Wipe MFT Free Space if you want to have the file names wiped and renamed). Am I right?


Spot on.

However, if you have not yet deleted a file and want it securely deleted, wiped from MFT and renamed - you can do so by deleting it via CCleaner. Am I right? My question is then, do you do this by choosing the include alternative in options, or how do you do it?


When you run the Cleaner section of CC, with either the default settings or your own custom set of boxes checked, CC will delete a specific set of files, as shown in an Analyse run. If, prior to the Cleaner run, you go to Options/Settings and check Secure File Deletion, One Pass, Wipe Alternate Data Streams and Wipe Cluster Tips, then the Cleaner run will overwrite all the file data and file names in the MFT - for this specific set of files. (Secure File Deletion is a separate option from Wipe Free Space.)

If you want a file, or files, deleted that aren't included in CC's standard clean, then you can enter the path and file name in the Include section, and check the Custom Files and Folders box in Cleaner/Advanced.

Also, I'm not really sure what this is supposed to mean:

"CCleaner can only securely delete files which have not yet been deleted from the Recycle Bin. If you have already delete files insecurely (for example, using Windows Explorer), you can delete them securely using Recuva."

But if I run a wipe free space (with everything else checked, including the Secure file deletion (Slower) option) - won't these already deleted files become securely deleted. Or is that just a terminology thing - where these already deleted but not securely deleted files will become wiped?


This has caused confusion before. It means that CC will only securely delete live files and files in the recycyler (if you have that option checked). If you have done a shift/del, for instance, the file will not have been securely deleted and can't be using CC, as CC's Cleaner section only deletes live files and files in the recycler. Then you may use Recuva, which will not remove the file name from the MFT, as the operating system won't allow it to do so.

You can use CC Wipe Free Space to overwrite all the free space on the disk, and the MFT entries. This will overwrite (which is secure deletion) every deleted file on the disk. (Perhaps the quote from the docs was written before CC's Wipe Free Space was introduced.) Again, Secure File deletion and Wipe Free Space are separate processes.

#5 OFFLINE Alan_B

Alan_B

    Super Hero

  • Members
  • PipPipPipPipPip
  • 4,280 posts
  • Gender:Male
  • Location:Lancashire, England

Posted 12 July 2012 - 02:47 PM

One advantage of using Recuva for Secure Deletion is that it may develop your patience as you wait for Recuva to trawl though 1 TB of free space looking for the dozen files you just deleted,
I guess (because I have never done it) that it would take much longer than the dozen seconds it takes for CCleaner to instantly locate and then secure delete those files.

#6 OFFLINE Greger

Greger

    Member

  • Members
  • PipPip
  • 17 posts

Posted 15 July 2012 - 02:53 PM

Alright, thanks for the answers!