Hey All,
Help me settle a bet…It’s my contention that
if you: delete a file (say… a word document or a temp file) and use a really good erase/overwrite utility (I personally use “ERASER”) and defrag the $mft properly then there will be no evidence that a given file ever existed on your pc… As Palmetto expertly pointed out to me in a different post, the MFT defrag will remove the file pointer, but the data will still be there…Is there a way to “clear” the data from “unused” MFT space? If so, does that truly mean that for all intent and purposes, the file never “existed” on you pc? Or could it somehow still be located & read?
TIA….
NICK
