[C/C++] Removing deleted files from the MFT

[ayu]

I'm planning to make a more "complete" application of my little shredder code (thanks IceDane for the block tip), but I need to be able to remove files from the MFT (Master FIle Table) that has already been deleted.

You see, in NTFS (and FAT as well I believe) the MFT holds a list of all the files in the file system, and when you delete a file all that happens is that the entry in the MFT is marked as "free". The data is not removed and the entry is not removed. So far my application can remove the data by overwriting it, but what it can't do is to remove the file entry from the MFT.

And I haven't been able to find a definite way to do so.
I have, however, found several other shredder applications that can do exactly what I want to do, but not much on how to do it in more detail.

If anyone has an idea on how to remove entries from the MFT (I want to be able to remove specific ones as well), then I would be very grateful

[Gogeta70]

Hmm, this may help...
http://www.installsetupconfig.com/win32 ... s1_18.html

Which i found here:

http://www.installsetupconfig.com/win32 ... index.html

Good luck

[IceDane]

After doing a bit of google magic with stuff from gogeta's link, I found this:

http://msdn.microsoft.com/en-us/library ... S.85).aspx

As far as I can see, it seems to be exactly what you want.

EDIT:

Right after posting, I found this: http://msdn.microsoft.com/en-us/library/aa964911

That seems pretty interesting. If I read it right, you can open a file with CreateFile, pass it to the function with that control code and you mark so that it gets zeroed upon deletion - then you delete it.

[ayu]

Hey guys, sorry that I haven't answered here.

Thanks for the links

Some of those stuff I have already taken a look on, but I will take yet another look just to be sure. I haven't had time to work on this little project, but I will continue it when I find more ime