This paper by Hal Berghel and David Hoelzer lists a whole bunch of products which claim to securely erase files. MFT cleaning is a feature of some of them. The paper concludes that only one product, Evidence Eliminator, actually does cleanup the MFT properly.
PGP Corp responds here to criticism of its own product, PGP Shred. Apparently it has an advanced option, "Wipe NTFS Internal Data Structures" which will clean the MFT, although this option is not enabled by default.
I've used PGP Shred myself so to some extent I can recommend it, but I confess I've never checked whether the MFT wiping feature actually works as described.
Clearly vendors sometimes overstate the abilities of their software, so your mileage may vary. If it's really important to you that the MFT entries are properly wiped, you may want to run disk forensics tools over your disk post-wipe - some ideas on how to do this are in the Berghel and Hoelzer paper.
Mmm. The question is wrong. I mean on an in-use volume that the entries left-over in the MFT, from files which once existed but now are gone, those entries are cleaned up.
It sounds a lot like you're asking for a program that will zero-out parts of the MFT that don't currently represent actual files. I'm going to go out on a limb here and say that no company is going to touch that one even with a stick.
NTFS is poorly documented at best
NTFS is a moving target, and the MFT is one of those "hands off" areas that are subject to change without notice
Overwriting presumably unused areas of this block offers zero benefit to the average user
Zeroing out the "free" space means zapping every bit that you don't think microsoft is using for anything important, a tenuous prospect at best.
A mistake in this operation (which is surprisingly likely) means losing files at best, losing the whole filesystem at worst
In other words, the project would be expensive and time consuming to build, would be riddled with uncertainty about its safety, and would not offer enough (any?) benefit to customer to convince them to use it.
I can't imagine such a thing exists, nor do I expect that it ever will.
我建议使用 CCleaner 生成 8000 个额外的 mft 条目，然后使用 Paragon HD Manager 启动 CD 截断 mft，然后重新启动并删除 zzz.zzz 文件。
I found a satisfactory solution for this problem, check and test if you like:
Paragon HD Defrag, which is part of Paragon HD manager 2010, and using the boot cd of that product, has the function or option to truncate the MFT. The utility cuts off any excess mft entries that are not in use. (nice)
These days there also is Piriform CCleaner. It claims to overwrite mft entries. It generates tons of files called variations of zzzz.zzzz
I would suggest to generate say 8000 extra mft entries with CCleaner, then truncate mft using Paragon HD Manager boot CD, then restart and shift+delete the zzz.zzz files.
I tried ccleaner, and other tools to zero out unused MFT references.
I then searched with a hex editor for files I had previously deleted - and found them.
Then I performed a full format while re-installing windows 7, ran the hex editor again and they were still there. I was quite shocked that a full format and re-install didn't overwrite the MFT.
The only way I got rid of everything was to use DBAN.
发布评论
评论（5）
Hal Berghel 和 David Hoelzer 的本文列出了一大堆声称可以安全删除文件的产品。 MFT 清洁是其中一些的特色。 该论文的结论是，只有一种产品，Evidence Eliminator，实际上能够正确清理 MFT。
PGP Corp 在此处回复对自己的产品 PGP Shred 的批评。 显然它有一个高级选项“擦除 NTFS 内部数据结构”，它将清理 MFT，尽管默认情况下未启用此选项。
我自己使用过 PGP Shred，所以在某种程度上我可以推荐它，但是我承认我从未检查过 MFT 擦除功能是否真的如描述的那样工作。
显然，供应商有时会夸大其软件的功能，因此您的里程可能会有所不同。 如果正确擦除 MFT 条目对您来说确实很重要，您可能需要在擦除后的磁盘上运行磁盘取证工具 - Berghel 和 Hoelzer 论文中提供了有关如何执行此操作的一些想法。
This paper by Hal Berghel and David Hoelzer lists a whole bunch of products which claim to securely erase files. MFT cleaning is a feature of some of them. The paper concludes that only one product, Evidence Eliminator, actually does cleanup the MFT properly.
PGP Corp responds here to criticism of its own product, PGP Shred. Apparently it has an advanced option, "Wipe NTFS Internal Data Structures" which will clean the MFT, although this option is not enabled by default.
I've used PGP Shred myself so to some extent I can recommend it, but I confess I've never checked whether the MFT wiping feature actually works as described.
Clearly vendors sometimes overstate the abilities of their software, so your mileage may vary. If it's really important to you that the MFT entries are properly wiped, you may want to run disk forensics tools over your disk post-wipe - some ideas on how to do this are in the Berghel and Hoelzer paper.
这听起来很像您在要求一个程序将 MFT 当前不代表实际文件的部分清零。 我要大胆地说，没有一家公司会用棍子去碰那个人。
换句话说，该项目的构建成本高昂且耗时，将充满安全性的不确定性，并且不会为客户提供足够的（任何？）好处来说服他们使用它。
我无法想象这样的事情存在，也不期望它会存在。
It sounds a lot like you're asking for a program that will zero-out parts of the MFT that don't currently represent actual files. I'm going to go out on a limb here and say that no company is going to touch that one even with a stick.
In other words, the project would be expensive and time consuming to build, would be riddled with uncertainty about its safety, and would not offer enough (any?) benefit to customer to convince them to use it.
I can't imagine such a thing exists, nor do I expect that it ever will.
我找到了一个令人满意的解决方案，如果您愿意，请检查和测试：
Paragon HD Defrag，它是Paragon HD manager 2010的一部分，并且使用该产品的启动光盘，具有截断MFT的功能或选项。 该实用程序会切断任何多余的未使用的 mft 条目。 （很好）
最近也有 Piriform CCleaner。 它声称会覆盖 mft 条目。 它会生成大量称为 zzzz.zzzz 变体的文件，
我建议使用 CCleaner 生成 8000 个额外的 mft 条目，然后使用 Paragon HD Manager 启动 CD 截断 mft，然后重新启动并删除 zzz.zzz 文件。
I found a satisfactory solution for this problem, check and test if you like:
Paragon HD Defrag, which is part of Paragon HD manager 2010, and using the boot cd of that product, has the function or option to truncate the MFT. The utility cuts off any excess mft entries that are not in use. (nice)
These days there also is Piriform CCleaner. It claims to overwrite mft entries. It generates tons of files called variations of zzzz.zzzz
I would suggest to generate say 8000 extra mft entries with CCleaner, then truncate mft using Paragon HD Manager boot CD, then restart and shift+delete the zzz.zzz files.
我尝试了 ccleaner 和其他工具来将未使用的 MFT 引用归零。
然后我用十六进制编辑器搜索我之前删除的文件 - 并找到了它们。
然后我在重新安装 Windows 7 时执行了完整格式化，再次运行十六进制编辑器，它们仍然存在。 令我感到非常震惊的是，完全格式化并重新安装并没有覆盖 MFT。
我摆脱一切的唯一方法是使用 DBAN。
I tried ccleaner, and other tools to zero out unused MFT references.
I then searched with a hex editor for files I had previously deleted - and found them.
Then I performed a full format while re-installing windows 7, ran the hex editor again and they were still there. I was quite shocked that a full format and re-install didn't overwrite the MFT.
The only way I got rid of everything was to use DBAN.
您可以使用 SDelete 将剩余可用空间归零
you could use SDelete to zero your remaining free space