Click here to Skip to main content
15,867,488 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I want to wipe all file in a folder. So I use CFile class to open a volume. Then parase the MFT and data to be wiped of files.
C++
MoveFile(lpszCurFilePath, lpszReplacedFilePath);

// Use Window API to delete the file
if (!DeleteFile(lpszReplacedFilePath))	
    return; 

//FlushFileBuffers(pVolFileTool->VolRWMgr.m_hFile);	

WipeFile(pVolFileTool, WipeDataList, nWipeMethod); // write zero to the MFT and data block

But every time I run the project,the file MFT cannot be wiped while the data can be wiped. But when I use dubug mode, the MFT and data are all wiped. Then I guess that DeleteFile function may protect the MFT from being writen for a while. So I use FlushFileBuffers function to flush the write buffer. Then the result is ok ,when I just wipe one file. But when I wipe more files, the MFTs that has been wiped may be recoverd.That is very amazing! So, is there good solution to this problem?
Posted
Updated 29-Sep-22 7:58am
v2
Comments
Rage 13-May-15 6:54am    
What is WipeFile exactly doing (is this your own function or part of an API ? A quick search could not enlighten me).
梅君 19-May-15 0:43am    
WipeFile uses CFile.Write to write zero to the MFT block and data block while I open the volume as a CFile object.

1 solution

Just thought I'd mention that writing over a file doesn't delete it totally, or even close.

If you are using an SSD, then the data is not overwritten at all - the new data is written to a free block and the old data remains in the old block for recycling when all other blocks have been used. This is done to even out writes across the whole substrate as SSD's wear out by writing. It is very, very easy to recover all the data unless you have recycled every single block on the SDD - which would start degrading it's lifetime significantly. The same applies to EMMC, USB thumb drive, and all other electronic media.

If you are using a HDD, the data is recoverable due to the way the magnetic substrate responds to changes - it is normally possible to retrieve at least the last five values written to any sector, plus the first dataset ever written to it. It's even more persistent if the same values are written to it repeatedly!

That's why disk wipers are complicated, why there are DoD rules on disk wiping, and why my old HDDs and SSD's get physically destroyed if they ever contained sensitive data! :D
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900