Software Recovery has come a long way and recovery software that can recover files from storage devices or hard disks even when it is completely formatted. We have personally reviewed several data recovery software, and yes, they do work, even if partially. In this post, we will see how it works and how you can clean your hard disk, including the MFT, to prevent recovery of deleted files.
What is the Master File Table (MFT)
The Master File Table is specific to NTFS and is like a logbook. It maintains a record of all the files available on that storage device. Other information, such as file size, time and date stamps, permissions, and data content, is also stored in MFT. As more files are added, the volume keeps increasing. This is the primary reason why OS reserves part of the storage, which is less than the total available space.
When a file is deleted, the entry still exists, and so does the file. However, in MFT, the file entry is marked as free. So when a new file arrives, the place can be reused. Till then, the data is there as is, and that’s how Recovery software works. They will look at the MFT table and show you the deleted files, and also let you recover it.
How to wipe Hard Disk and MFT clean
So now that you know how it works, there are two ways to prevent restoration. You can completely wipe your hard disk clean using some secure delete software – so that eventually, the MFT table has nothing to reveal. The second way is to overwrite the deleted files’ data with something else. So even if the MFT has the file location, the data will be invalid.
Let us take a look at two free software that can help you with this. While you can, perform these operations often, on an SSD it will likely reduce the life of SSD.
1 ] Cyrobo Prevent Recovery
The interface is straightforward. Launch the software to detect the partitions connected to the computer.
- Select the partition for which you want to run the anti-recovery operations.
- In the next screen, you can choose to overwrite data using spaces, random characters, random numbers, or special technical signs.
- Then you need to choose the type of security, but since this is a free version, you cannot. So click Next.
- Lastly, you can choose to clean MFT tables with the percentage of free disks to be overwritten. 100% is recommended.
- Post this, the software will search for deleted files, overwrite them, and also clear the MFT entries.
The time taken to complete this will depend on the speed of your hard drive. For a single overwrite on my HDD, it took around 50 minutes.
Download the free version of Prevent Recovery. It offers to wipe using MFT data and has no restrictions. The Pro version offers a better security algorithm to delete files, better interface, and priority support. The software claims that it uses 12 security algorithms to ensure even security services find it hard to recover data from an existing drive.
2] CCleaner Wipe MFT Free Space
CCleaner offers the same feature but with a different approach. The first approach is along with its cleaning operation, and the second is a dedicated Wipe Free Space tool.
Wipe Free Space drives
When you set this up, CCleaner keeps deleting files permanently using MFT free space technique every time you delete a file.
- Open CCleaner, and go to Options > Settings > Wipe Free Space Drives
- Select the drive for which you want to perform every time you delete files
- Check the box which says Wipe MFT Free Space
Drive Wiper
This is useful when you are handing your PC to someone else or if you do not have the above option enabled earlier.
- Go to Tools > Drive Wiper
- Select Free Space only under Wipe
- Choose the type of security wipe, which can be one time to thirty-five times.
- Select one or more drive
- Then click on the Wipe to kickstart the process.
The best part of using the tools is that you can use it on an existing hard disk without worrying about losing your data. Since it only overwrites whatever is free – the rest of the data is safe.
Does deleting Master File Table work?
It is a tough question because what really matters is which security algorithm was used to wipe data. There are high-end software that can retrieve data even if you have wiped them once or can break the algorithm that was used to wipe the data. We tested it with a recovery software I use often to test recovery, and I had seen it work. However this time, it failed to recover data when scanned.
Cyrobo Prevent Recovery result
We saw hundreds of files in the temp folder and Recycle bin, but none of them could be viewed after the recovery. The advanced scan was not able to recover any file, but it did reveal file names here and there.
CCleaner Wipe MFT Free Space result
The results from CCleaner, where we used the Wipe Drive Feature (Free Space only), were interesting. In both the quick and advanced scans, all we could see were tons of files named with ZZZZ. It looks like CCleaner did a lot better job than Cyrobo Prevent Recovery.
I think it’s good for consumers to have options like these. Some OEMs bundle software to wipe clean their drives, but if you find it hard to trust, use one of these. Also, if it’s important, I suggest looking for professional software.
Related read: File Shredder software.
