Safetly removing deleted data

**azureee** · 12.01.09, 18:34

Greetings,

does anyone knows a good app for securely remove deleted data from NTFS? I read that data from MFT can't never be removed, so even after you shift+del a file, their data stay there and even it's name is still written in the MFT. I checked Paragon Disk Manager, but it seems it can't completely remove MFT entries from system partition, but as far as i see other partitions where wiped ok. Do you have any additional recomendation in this subject?

Regards,
fw190d9

**anon** · 12.01.09, 18:35

Edited: that program wipes your whole disk, not just files!

But Eraser should do fine.

**azureee** · 12.01.09, 19:06

Greetings,

thanks for your fast reply, but I'm actually looking for something less "agressive". I wish to keep my partition, only wiping unused data. The two major problems are MFT keeping removed file entries and last cluster of allocated files keeping traces of older delete files in their "free" space (remember that last cluster is almost never fully filled).

Regards,
fw190d9

**anon** · 12.01.09, 19:14

You can use Eraser's "Unused Disk Space" erasing facility, which also removes MFT records and directory entries. (Task -> Preferences -> Erasing...) I have linked to it above.

**azureee** · 12.01.09, 19:50

I created an task for free space cleaning and later tested deleted data with Stellar Phoenix Recovery. All data were cleaned as I expected.
Thank you very much! Great software!

Regards,
fw19d9

**anon** · 12.01.09, 20:00

Originally Posted by azureee

Sorry for thank you using a message. Newbie mistake. I haven't read the rules yet.

Your previous post wasn't a Thanks post because you've posted the results of testing whether the files were really deleted.

**azureee** · 13.01.09, 13:12

Greetings,

I did more tests and found that some entries weren't removed from MFT. Although Eraser seems to remove unused data, directories removed and not linked from other existing directories are still kept in MFT wich as a result can contain traces of old data. In other words, data were removed but some filenames are still in the MFT.

I found another wiping tool, called sdelete. It's from Microsoft, so I'm not so sure whether I can trust it or not. Anyways, this tool try to deal with MFT entries and its results are better than Eraser when the subject is MFT wiping. The only weakness is that I couldn't wipe MFT from system partition.

Regards,
fw190d9

**anon** · 13.01.09, 16:02

Originally Posted by azureee

...
I found another wiping tool, called sdelete. It's from Microsoft, so I'm not so sure whether I can trust it or not. Anyways, this tool try to deal with MFT entries and its results are better than Eraser when the subject is MFT wiping. The only weakness is that I couldn't wipe MFT from system partition.

Yes, I have heard about SDelete before, and am pretty sure you can trust it despite being from Microsoft.

So according your tests it works better than Eraser to delete MFT entries?

On NTFS drives SDelete's job isn't necessarily through after it allocates and overwrites the two files. SDelete must also fill any existing free portions of the NTFS MFT (Master File Table) with files that fit within an MFT record. An MFT record is typically 1KB in size, and every file or directory on a disk requires at least one MFT record. Small files are stored entirely within their MFT record, while files that don't fit within a record are allocated clusters outside the MFT. All SDelete has to do to take care of the free MFT space is allocate the largest file it can - when the file occupies all the available space in an MFT Record NTFS will prevent the file from getting larger, since there are no free clusters left on the disk (they are being held by the two files SDelete previously allocated). SDelete then repeats the process. When SDelete can no longer even create a new file, it knows that all the previously free records in the MFT have been completely filled with securely overwritten files.

Looks a bit like how Diskeeper "resizes" the MFT to me.

**azureee** · 13.01.09, 19:34

Originally Posted by anon

So according your tests it works better than Eraser to delete MFT entries?

Tests are still inconclusive, because I'm running it over a Remote Desktop connection (I'm at work and my machine at home) and it seems there are some problem scheduling a wiping at boot time over this connection. I remember I had tested in my notebook, at home, and wiping took a lot of time. Now the remote boot+wiping are too fast to be right, I'm almost sure it hasn't been executed.

I'm going to conduct new tests when I get home and I hope to have a conclusion later night.

Regards