I have done a bit of research into how recover deleted file tools work on NTFS under Windows. By deletion, I mean deletion while omitting the recycling bin. What I am trying to achieve is the following:
- Find deleted files, and write over them.
- Find all unallocated space on a drive and zero the contents. I thought that this approach would make the first objective moot. However, I have seen programs that access the MFT but succeed only to an extent. The MFT seems to hold on to deleted entries for a while (with a flag), then removes them.
I code in C# .NET and was wondering how to approach the challenge of accessing any space on a given drive that does not have active file data, and zeroing it.
I feel that looking at the source code of a defragmentation tool may help, but I still do not know how to access unallocated space directly to manipulate it.
EDIT: Please note that this question is not about formatting drives.
