软件恢复(Software Recovery)已经走过了漫长的道路，恢复软件可以从存储设备或硬盘中恢复文件，即使它已完全格式化。我们亲自审查了几个数据恢复软件(data recovery software)，是的，它们确实有效，即使部分有效。在这篇文章中，我们将了解它是如何工作的，以及如何擦除包括MFT在内的硬盘，以防止恢复已删除的文件。
什么是主文件表 (MFT)
主文件表(Master File Table)是特定于NTFS的，它就像一个日志。它维护该存储设备上所有可用文件的记录。除此之外，其大小、时间和日期戳、权限和数据内容等其他信息也存储在MFT中。随着越来越多的文件被添加，音量不断增加。这是操作系统保留部分存储空间的主要原因，这小于总可用空间。
当一个文件被删除时，该条目仍然存在，该文件也是如此。但是，在MFT中，文件的条目被标记为空闲。所以当一个新文件到达时，这个地方可以被重用。到(Till)那时，数据就在那里，这就是恢复(Recovery)软件的工作方式。他们将查看MFT表并向您显示已删除的文件，并让您恢复它。
如何将硬盘和 MFT 擦干净
因此，既然您知道它是如何工作的，那么有两种方法可以防止恢复。您可以使用一些安全删除软件(secure delete software)彻底清除您的硬盘——这样最终，MFT表就没有什么可显示的了。第二种方法是您是否可以用其他内容覆盖已删除的文件数据。所以即使MFT有文件位置，数据也是无效的。
让我们看一下可以帮助您解决此问题的两个免费软件。虽然您可以经常执行这些操作，但在SSD上它可能会缩短SSD的寿命。
1] Cyrobo 防止恢复
界面是直截了当的。启动软件，它将检测连接到计算机的分区。
- 选择要运行反恢复操作的分区。
- 在下一个屏幕中，您可以选择使用空格、随机字符、随机数、特殊技术符号覆盖数据的选项。
- 然后您需要选择安全类型，但由于这是免费版本，您不能。所以点击下一步(Next)。
- 最后，您可以选择清除要覆盖的可用磁盘的MFT表百分比。(MFT)建议 100%。
- 发布此消息后，该软件将搜索已删除的文件，覆盖它们，并清除MFT条目。
完成此操作所需的时间取决于硬盘驱动器的速度。一次覆盖在我的硬盘上花费了大约 50 分钟。(HDD)
下载(Download the free version)防止恢复(Prevent Recovery)的免费版本。它提供使用MFT数据擦除并且没有限制。专业(Pro)版提供了更好的文件删除安全算法、更好的界面和优先支持。该软件声称他们使用 12 种安全算法来确保即使是安全服务也很难从现有驱动器中恢复数据。
2] CCleaner 擦除 MFT 可用空间
CCleaner提供了相同的功能，但采用了不同的方法。第一种方法是连同它的清洁操作，第二种方法是专用的擦除可用空间(Wipe Free Space)工具。
擦除可用空间驱动器
当您进行设置时，CCleaner会在您每次删除文件时使用MFT可用空间技术永久删除文件。
- 打开CCleaner，然后转到Options > Settings > Wipe Free Space Drives
- 选择每次删除文件时要执行的驱动器
- 选中显示擦除 MFT 可用空间(Wipe MFT Free Space)的框
驱动雨刮器
当您将 PC 交给其他人或您之前没有启用上述选项时，这很有用。
- 转到工具 > 驱动刮水器
- 在擦除下选择仅可用空间
- 选择安全擦除类型，可以是 1 次到 35 次。
- 选择一个或多个驱动器
- 然后单击“擦除(Wipe)”以启动该过程。
使用这些工具最好的部分是您可以在现有硬盘上使用它，而不必担心丢失数据。因为它只覆盖任何空闲的数据——其余数据是安全的。
(Does)删除主文件表(Master File Table)是否有效？
这是一个棘手的问题，因为真正重要的是使用哪种安全算法来擦除数据。有一些高端软件可以检索数据，即使您已经擦除了一次数据，或者可以破坏用于擦除数据的算法。我们使用我经常用于测试恢复的恢复软件对其进行了测试，并且我已经看到它有效。但是这一次，它在扫描时无法恢复数据。
Cyrobo 防止恢复结果
我们在临时文件夹和回收站(Recycle)中看到了数百个文件，但在恢复后无法查看它们。高级扫描无法恢复任何文件，但它确实到处显示文件名。
CCleaner 擦除 MFT 可用空间结果(CCleaner Wipe MFT Free Space result)
CCleaner的结果很有趣，我们使用了擦除驱动器(Wipe Driv)功能（(Feature)仅限可用空间(Space)）。在快速和高级扫描中，我们只能看到大量以ZZZZ命名的文件。(ZZZZ)看起来CCleaner比Cyrobo Prevent Recovery 做得更好(Cyrobo Prevent Recovery)。
我认为有这样的选择对消费者有好处。一些原始设备制造商(OEMs)捆绑软件来擦除他们的驱动器，但如果您觉得难以信任，请使用其中之一。另外，如果它很重要，我建议寻找专业软件。
相关阅读：(Related read: )文件粉碎机软件(File Shredder software)。
How to wipe Hard Disk and MFT clean to prevent recovery of deleted files
Software Recovery has come a long way and recovery software thаt can recover files from storage deviсes or hard dіsks even when it is сompletеly formatted. We have personally reviewed several data recovery software, and yes, they do work, even if partially. In this post, we will see how it works, and how you can wipe your hard disk, including the MFT, clean to prevent recovery of deleted files.
What is the Master File Table (MFT)
The Master File Table is specific to NTFS, which is like a logbook. It maintains a record of all the files that are available on that storage device. Apart from this, other information like its size, time and date stamps, permissions, and data content, is stored either in MFT. As more and more files are added, the volume keeps increasing. It is the primary reason why OS reserves part of the storage, which is less than the total available space.
When a file is deleted, the entry still exists, and so does the file. However, in MFT, the entry for the file is marked as free. So when a new file arrives, the place can be reused. Till then, the data is there as is, and that’s how Recovery software works. They will look at the MFT table and show you the deleted files, and also let you recover it.
How to wipe Hard Disk and MFT clean
So now that you know how it works, there are two ways to prevent restoration. You can completely wipe your hard disk clean using some secure delete software – so that eventually, the MFT table has nothing to reveal. The second way is if you can overwrite the deleted files data with something else. So even if the MFT has the file location, the data will be invalid.
Let us take a look at two free software that can help you with this. While you can, perform these operations often, on an SSD it will likely reduce the life of SSD.
1 ] Cyrobo Prevent Recovery
The interface is straight forward. Launch the software, and it will detect the partitions connected to the computer.
- Select the partition for which you want to run the anti-recovery operations.
- In the next screen, you can choose an option to overwrite data using spaces, random character, random number, special technical signs.
- Then you need to choose the type of security, but since this is a free version, you cannot. So click Next.
- Lastly, you can choose to clean MFT tables percentage of free disk to be overwritten. 100% is recommended.
- Post this, the software will search for deleted files, overwrite them, and also clear the MFT entries.
The amount of time taken to complete this will depend on the hard drive speed. It took around 50 minutes on my HDD for a single overwrite.
Download the free version of Prevent Recovery. It offers to wipe using MFT data and has no restriction. The Pro version offers a better security algorithm to delete files, better interface, and priority support. The software claims that they use 12 security algorithms to make sure even security services find it hard to recover data from an existing drive.
2] CCleaner Wipe MFT Free Space
CCleaner offers the same feature but with a different approach. The first approach is along with its cleaning operation, and the second is a dedicated Wipe Free Space tool.
Wipe Free Space drives
When you set this up, CCleaner keeps deleting files permanently using MFT free space technique every time you delete a file.
- Open CCleaner, and go to Options > Settings > Wipe Free Space Drives
- Select the drive for which you want to perform every time you delete files
- Check the box which says Wipe MFT Free Space
Drive Wiper
This is useful when you are handing your PC to someone else or if you do not have the above option enabled earlier.
- Go to Tools > Drive Wiper
- Select Free Space only under Wipe
- Choose the type of security wipe, which can be one time to thirty-five times.
- Select one or more drive
- Then click on the Wipe to kickstart the process.
The best part of using the tools is that you can use it on an existing hard disk without worrying about losing your data. Since it only overwrites whatever is free – the rest of the data is safe.
Does deleting Master File Table work?
It is a tough question because what really matters is which security algorithm was used to wipe data. There are high-end software that can retrieve data even if you have wiped them once or can break the algorithm that was used to wipe the data. We tested it with a recovery software I use often to test recovery, and I had seen it work. However this time, it failed to recover data when scanned.
Cyrobo Prevent Recovery result
We saw hundreds of files in the temp folder and Recycle bin, but none of them could be viewed after the recovery. The advanced scan was not able to recover any file, but it did reveal file names here and there.
CCleaner Wipe MFT Free Space result
The results from CCleaner where we used the Wipe Driv e Feature (Free Space only) were interesting. All we could see were tons of files named with ZZZZ in both quick and advanced scan. Looks like CCleaner did a lot better job compared to Cyrobo Prevent Recovery.
I think its good for consumers to have options like these. Some of the OEMs bundle software to wipe clean their drives, but if you find it hard to trust, use one of these. Also, if it’s important, I would suggest looking for professional software.
Related read: File Shredder software.
