General discussion



By npmarica ·
Hey all,

Help me settle a bet...It's my contention that

if you:

1) delete a file (say... a word document or a temp file)
2) use a good erase utility and
3) defrag the $mft properly


there will be no evidence that a given file ever existed on your pc...

True or false? I stand ready to be corrected, but I think I'm correct.

TIA for your thoughts and input!!!

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

Likely false

by CharlieSpencer In reply to DEFRAG $MFT AND FILE ERAS ...

1) Deleting the file just removed the file pointer from the MFT so it can be reused. Nothing is actually erased and it's quite easy to recover the file with command line tools at this stage.

2) Here's where the 'maybe' creeps in. This depends on your erase utility. More on that in a moment.

3) So you defrag'ed the MFT. It wouldn't matter if you defraged the hard drive. Unless the area formerly allocated to the file was overwritten, the data is still there. At this stage it may require a data recover firm to get it back, but if the defrag didn't write over those portions of drive then they'll be able to.

Personally I would have performed the second step first, using a utility that allows you to specify a file name and mandate the area occupied be overwritten several times. But that's not the question you asked.

Collapse -


by npmarica In reply to Likely false

I stand corrected...but isn't there a way that you could overwrite the newly "unused" records in the $MFT? Can you get rid of the data in the $MFT

Collapse -

Repost as a 'Question'

by CharlieSpencer In reply to THANKS!

Standard reply:

Post problems such as this to the "Question" forum, rather than the "Discussion" forum. There are those who specifically seek out problems in need of a solution, and that's where they go to look for such.

Additionally there are the benefits that:

1) The "Questions" forum provides for your feedback, by way of your being able to mark "helpful" responses as such. This does not necessarily mean that a given response contained the complete solution to your problem, but only that it served to guide you toward it. This is intended to serve as an aid to those who may in the future have a problem similar to yours, so that they might have a ready source of reference available, thereby perhaps obviating the need for them to repeat questions previously asked and answered.

2) The revised TR makes it quite difficult to find both "Discussions" and "Questions" that have not had a fairly recent post, owing to some functions commingling them in the listings. By keeping each type in their respective forums, it is easier for all to find what they are looking for.

Incidentally, it's considered impolite in this forum to send a peer message for additional information. The reason for this is because it deprives future readers with the same question of being able to get all the information.

Oh, and most of what I posted was nothing more than a crude guess. You definitely need to repost this as a question so you can get better qualified assistance than I can provide.

Collapse -

Upgrade crude to educated ;-)

by IC-IT In reply to Repost as a 'Question'

Pretty much spot on Palmetto.

Collapse -


by npmarica In reply to Upgrade crude to educated ...

Thanks guys...will do...

Related Discussions

Related Forums