Overwriting a files in place on NTFS

Question

Let's say I have a Python program that opens a file and overwrites it with zeros, and I run it on a Windows 7 computer formatted in NTFS. If this is done on an HDD (not an SSD) will the file be overwritten in place on the disk, or will the changes be written in a new sector and the file link updated?

Answer 1

Short answer:
Will the file be overwritten in place on the disk? Maybe.
For secure deletion of files, maybe, is not acceptable.

Longer answer:
I believe that depends on the flags used when opening the file and whether the file is compressed or encrypted. It seems many applications that look like they are just overwriting end up writing the new content to another location on the disk and leaving the original content still on the disk as well.

To check the before and after location of the file you can use the DiskView tool from http://technet.microsoft.com/en-au/sysinternals/bb896650.aspx

Are you looking for a tool that will write all free space with zeroes? There is a MS tool available for that but the way it works is that it creates new files filled with the same content (by default not zeros but compresses well anyway), and then deletes them all. See http://support.microsoft.com/kb/833138 for more info. It is also called "Virtual Disk Precompactor.ISO" and it is installed with Virtual PC or XP mode.

However this does create a short time when the disk is full and if the system is in use at the time it will spray new files all over the disk. I was thinking that if you could make use of the defragmentation APIs to move a zero filled file to all free space locations on the disk it would have less impact on the running system. But I've not seen any tools for doing this.

If you are looking for a tool to securely delete files there is one available from Microsoft on http://technet.microsoft.com/en-au/sysinternals/bb897443.aspx called sdelete which actually does some tricky things with the defragmentation API to actually erase sparse and compress files while just writing zeroes to those types of files will not write the zeroes to the same location as the old content due to the way ntfs works. The link for the sdelete program gives a description of this. Note that sdelete does not need to be installed as it is self contained.