MFT, USN Journal, $LogFile

A place to discuss data and privacy protection, file and disk wipe, computer cleaning, and removing traces of user activity with R-Wipe & Clean.
Forum rules
Discussion on the R-Wipe & Clean and R-Crypto software
Post Reply
rwiper

MFT, USN Journal, $LogFile

Post by rwiper » Fri Oct 25, 2019 4:57 am

R-TT Team, Please Do

Traces in MFT

Traces in USN Journal

Traces in $LogFile

Image
Top
rwiper

_OnDiskSnapshotProp files

Post by rwiper » Sun Oct 27, 2019 5:15 pm

{GUID}_OnDiskSnapshotProp files, in the \System Volume Information\SPP\OnlineMetadataCache are another file type that can provide information about shadow copies. You have pointed these out on your blog this past week. The GUID portion of the file name will match the GUID of the shadow copy set ID that you see when you run VSSadmin.exe. The file created date of the {GUID}_OnDiskSnapshotProp file will closely, but not exactly, match the date of the corresponding shadow copy. As shown below, examining the internals of a {GUID}_OnDiskSnapshotProp file will indicate the the date and time of a shadow copy within a few seconds to a minute, as well as the reason the shadow copy was created.

Image


C:\System Volume Information\
-Syscache.hve
-Syscache.hve.LOG1
-Syscache.hve.LOG2
-tracking.log
-MountPointManagerRemoteDatabase

C:\System Volume Information\SPP\OnlineMetadataCache
*._OnDiskSnapshotProp


MORE INFO
https://www.hecfblog.com/2014/06/daily- ... inner.html
Top
Alt
Site Moderator
Posts: 3134
Joined: Tue Nov 11, 2008 2:13 pm
Contact:
Contact Alt

Re: MFT, USN Journal, $LogFile

Post by Alt » Mon Oct 28, 2019 12:35 pm

Thank you for your suggestions. I've passed them to our developers.
Top
rwiper

Re: MFT, USN Journal, $LogFile

Post by rwiper » Mon Jan 13, 2020 5:17 pm

rwiper wrote: ↑
Fri Oct 25, 2019 4:57 am
 R-TT Team, Please Do

Traces in MFT

Traces in USN Journal

Traces in $LogFile

Image
Any news? :(
Top
Alt
Site Moderator
Posts: 3134
Joined: Tue Nov 11, 2008 2:13 pm
Contact:
Contact Alt

Re: MFT, USN Journal, $LogFile

Post by Alt » Mon Jan 20, 2020 9:18 am

You may clean MFT traces by cleaning free drive space. The help page Wiping Free Disk Space explains how. You may clean either MFT traces alone or together with free disk space by selecting the What to wipe option.

We're going to implement the rest of requests in our future releases. We need some additional time to test them against possible system instability.
Top
rwiper

Re: MFT, USN Journal, $LogFile

Post by rwiper » Mon Jan 20, 2020 11:37 am

Alt wrote: ↑
Mon Jan 20, 2020 9:18 am
 You may clean MFT traces by cleaning free drive space. The help page Wiping Free Disk Space explains how. You may clean either MFT traces alone or together with free disk space by selecting the What to wipe option.

We're going to implement the rest of requests in our future releases. We need some additional time to test them against possible system instability.
Thank you so much. I'm waiting. I love r-wipe so much.
Top
rwiper

Re: MFT, USN Journal, $LogFile

Post by rwiper » Sun Apr 19, 2020 4:24 pm

I just wonder. Will this feature come?
Top
Post Reply

Return to “Disk Wiping”