0

Say I have a file which is 5 megabytes. If I delete it (and delete it from recycle bin) and run "cipher /w:C:" on my drive, it should be unrecoverrable.

What about its entry in the MFT? I think the entry for the file will be marked as free but what are the chances that the entry will be overwritten within a certain amount of time (say if after I securely delete that file, I browse some webpages, which creates files in the cache.. will those cache files get entered in the MFT and overwrite the deleted file)?

useraccount001
  • 13

2 Answers2

1

If you delete the file from the recycle bin, it will be quickly overwritten on an averagely active machine. That is the disk space will be overwritten in a day or some days. So for all practical purposes (90%) the deleted file is gone because any surviving table entry will point to useless contents.

0

NTFS is still a proprietary file system and as far as i know, there is no information available on any kind of reliable retention mechanism for the MFT.

Overwriting the free space in no way assures you the MFT entry will be gone. Secure wiping with a tool like Recuva will therefor NOT remove entries from the MFT, but there are other tools that will allow you to do this.

CCleaner, for example, has an option to wipe free space based on the MFT. It will rewrite the free space and delete the MFT entry, but very slowly. Many other tools are available, you can google for them and find the one that fits your needs.

Silbee
  • 1,549
  • 8
  • 12