windows 主文件表清理实用程序？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/764304/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Master File Table cleanup utility?
提问by snowcrash09
回答by snowcrash09
This paperby Hal Berghel and David Hoelzer lists a whole bunch of products which claim to securely erase files. MFT cleaning is a feature of some of them. The paper concludes that only one product, Evidence Eliminator, actually does cleanup the MFT properly.
Hal Berghel 和 David Hoelzer 的这篇论文列出了一大堆声称可以安全擦除文件的产品。MFT 清洁是其中一些的一个特点。该论文得出的结论是，只有一种产品Evidence Eliminator真正正确地清理了 MFT。
PGP Corp responds hereto criticism of its own product, PGP Shred. Apparently it has an advanced option, "Wipe NTFS Internal Data Structures" which will clean the MFT, although this option is not enabled by default.
PGP 公司在此回应对其自有产品 PGP Shred 的批评。显然它有一个高级选项，“擦除 NTFS 内部数据结构”，它将清理 MFT，尽管默认情况下未启用此选项。
I've used PGP Shredmyself so to some extent I can recommend it, but I confess I've never checked whether the MFT wiping feature actually works as described.
我自己使用过PGP Shred，所以在某种程度上我可以推荐它，但我承认我从未检查过 MFT 擦除功能是否真的像描述的那样工作。
Clearly vendors sometimes overstate the abilities of their software, so your mileage may vary. If it's really important to you that the MFT entries are properly wiped, you may want to run disk forensics tools over your disk post-wipe - some ideas on how to do this are in the Berghel and Hoelzer paper.
显然，供应商有时会夸大其软件的能力，因此您的努力可能会有所不同。如果正确擦除 MFT 条目对您来说真的很重要，您可能希望在擦除后的磁盘上运行磁盘取证工具 - 有关如何执行此操作的一些想法在 Berghel 和 Hoelzer 论文中。
回答by tylerl
Mmm. The question is wrong. I mean on an in-use volume that the entries left-over in the MFT, from files which once existed but now are gone, those entries are cleaned up.
嗯。问题错了。我的意思是在使用中的卷上，MFT 中遗留的条目，来自曾经存在但现在消失的文件，这些条目被清除。
It sounds a lot like you're asking for a program that will zero-out parts of the MFT that don't currently represent actual files. I'm going to go out on a limb here and say that no company is going to touch that one even with a stick.
听起来很像您要求一个程序将当前不代表实际文件的 MFT 部分归零。我要冒昧地说一句，即使用一根棍子，也没有公司会去碰那个人。
- NTFS is poorly documented at best
- NTFS is a moving target, and the MFT is one of those "hands off" areas that are subject to change without notice
- Overwriting presumably unused areas of this block offers zero benefit to the average user
- Zeroing out the "free" space means zapping every bit that you don't think microsoft is using for anything important, a tenuous prospect at best.
- A mistake in this operation (which is surprisingly likely) means losing files at best, losing the whole filesystem at worst
- NTFS 充其量只是记录不佳
- NTFS 是一个不断变化的目标，而 MFT 是可能随时更改的“放手”区域之一，恕不另行通知
- 覆盖该块可能未使用的区域对普通用户的好处为零
- 将“免费”空间归零意味着将您认为微软没有用于任何重要事情的每一点都清除掉，充其量只是一个微弱的前景。
- 此操作中的错误（出乎意料地可能）意味着最多会丢失文件，最坏的情况是丢失整个文件系统
In other words, the project would be expensive and time consuming to build, would be riddled with uncertainty about its safety, and would not offer enough (any?) benefit to customer to convince them to use it.
换句话说，该项目的建造成本高昂且耗时，会充满对其安全性的不确定性，并且不会为客户提供足够的（任何？）利益以说服他们使用它。
I can't imagine such a thing exists, nor do I expect that it ever will.
我无法想象这样的事情存在，我也不希望它永远存在。
回答by Homy
I found a satisfactory solution for this problem, check and test if you like:
我为这个问题找到了一个令人满意的解决方案，如果您愿意，请检查并测试：
Paragon HD Defrag, which is part of Paragon HD manager 2010, and using the boot cd of that product, has the function or option to truncate the MFT. The utility cuts off any excess mft entries that are not in use. (nice)
Paragon HD Defrag 是 Paragon HD manager 2010 的一部分，使用该产品的引导 CD，具有截断 MFT 的功能或选项。该实用程序会切断任何未使用的多余 mft 条目。（好的）
These days there also is Piriform CCleaner. It claims to overwrite mft entries. It generates tons of files called variations of zzzz.zzzz
这些天还有 Piriform CCleaner。它声称会覆盖 mft 条目。它生成大量称为 zzzz.zzzz 变体的文件
I would suggest to generate say 8000 extra mft entries with CCleaner, then truncate mft using Paragon HD Manager boot CD, then restart and shift+delete the zzz.zzz files.
我建议使用 CCleaner 生成 8000 个额外的 mft 条目，然后使用 Paragon HD Manager 启动 CD 截断 mft，然后重新启动并移动 + 删除 zzz.zzz 文件。
回答by Sam
I tried ccleaner, and other tools to zero out unused MFT references.
我尝试了ccleaner和其他工具来将未使用的 MFT 引用归零。
I then searched with a hex editor for files I had previously deleted - and found them.
然后我用十六进制编辑器搜索我之前删除的文件 - 并找到了它们。
Then I performed a full format while re-installing windows 7, ran the hex editor again and they were still there. I was quite shocked that a full format and re-install didn't overwrite the MFT.
然后我在重新安装 Windows 7 时执行了完整格式，再次运行十六进制编辑器，它们仍然存在。我很震惊，完整的格式和重新安装没有覆盖 MFT。
The only way I got rid of everything was to use DBAN.
我摆脱一切的唯一方法是使用DBAN。
