主文件表清理工具？ [英] Master File Table cleanup utility?

问题描述

任何人都可以推荐 MFT 的工具清理？我想在我的MFT中恢复曾经存在但已被删除到pristine状态的文件的条目，并将其清零。

解决方案 div>

本文由哈尔Berghel和David Hoelzer列举了一大堆声称安全删除文件的产品。 MFT清洗是其中一些功能。该文件得出结论，只有一种产品，实际上清理MFT正确。

PGP Corp回应 =noreferrer>这里来批评自己的产品，PGP Shred。显然它有一个先进的选项，擦除NTFS内部数据结构，这将清理MFT，虽然这个选项没有默认启用。

我使用了 PGP Shred所以在某种程度上我可以推荐它，但我承认我从来没有检查过MFT擦除功能是否按照描述的那样工作。

夸大其软件的能力，所以你的里程可能会有所不同。如果你真的很重要，MFT条目已经被正确地抹掉了，你可能需要在磁盘擦除后运行磁盘取证工具 - 关于如何做到这一点的一些想法在Berghel和Hoelzer的文章中。 $ b

Can anyone recommend a tool for MFT cleanup? I want to in my MFT restore the entries for files which once existed but have been deleted to a "pristine" state, with zeroed out entries.

解决方案

This paper by Hal Berghel and David Hoelzer lists a whole bunch of products which claim to securely erase files. MFT cleaning is a feature of some of them. The paper concludes that only one product, Evidence Eliminator, actually does cleanup the MFT properly.

PGP Corp responds here to criticism of its own product, PGP Shred. Apparently it has an advanced option, "Wipe NTFS Internal Data Structures" which will clean the MFT, although this option is not enabled by default.

I've used PGP Shred myself so to some extent I can recommend it, but I confess I've never checked whether the MFT wiping feature actually works as described.

Clearly vendors sometimes overstate the abilities of their software, so your mileage may vary. If it's really important to you that the MFT entries are properly wiped, you may want to run disk forensics tools over your disk post-wipe - some ideas on how to do this are in the Berghel and Hoelzer paper.

这篇关于主文件表清理工具？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！