1

I'm trying to wipe some of my older (NTFS, external) hard drives, but even after using 'Wipe free space' programs like CCleaner and Eraser, the file names are still visible in file recovery programs. I'm guessing this is because the MFT, journal, etc. are still present and contain references to these files.

My first thought was to just format the drive and then wipe, but I'm guessing that's still not totally going to do the trick. Would formatting to exFAT and then wiping make a difference (as it uses a different structure)?

Edit: This is not a duplicate. The other thread does not mention wiping file references specifically, and the top answer is to use DBAN, which is not a possibility with external drives.

2 Answers2

2

Try using Microsoft's built in free space wiping tool. Open an administrative command prompt, go to the drive to wipe and type:

cipher /w:F

Keltari
  • 75,447
1

Preventing Data Recovery

In order to prevent data from being recovered, the data itself and all references to it should be overwritten. There is ongoing discussion as to how exactly it should be overwritten (number of times, patterns used, etc.) so you should choose based on the importance of the data not being recovered, and the reason for making it so.

Windows

If (as assumed by your use of NTFS) you are using a recent (Vista or newer) Microsoft OS, there is the format command available, which will write zeros to the disk when you do a standard (non-quick) format.

This only erases the partition you select, so keep that in mind if you have more than one.

Linux

If you are using Linux, or are willing to boot off a Linux disk to wipe your drive, the entire disk can be erased using the dd utility. For example, to completely overwrite the partition table and all data, you could run:

dd if=/dev/zero of=/dev/sda

Warning!

Modern hard drives may have wear leveling or other features that result in some storage space being untouched using the above methods.

It may be possible to ensure all data is removed by using the "Secure erase" feature of the drive - assuming you trust the manufacturer. This can be done using the hdparm tool by:

Setting the password

# hdparm --user-master u --security-set-pass Pass /dev/sda
security_password="Pass"

Running secure erase

# hdparm --user-master u --security-erase Pass /dev/sda
security_password="Pass"

Verifying

# hdparm -I /dev/sdb
DougC
  • 384