MFT, USN Journal, $LogFile
Forum rules
Discussion on the R-Wipe & Clean and R-Crypto software
Discussion on the R-Wipe & Clean and R-Crypto software
MFT, USN Journal, $LogFile
R-TT Team, Please Do
Traces in MFT
Traces in USN Journal
Traces in $LogFile
Traces in MFT
Traces in USN Journal
Traces in $LogFile
_OnDiskSnapshotProp files
{GUID}_OnDiskSnapshotProp files, in the \System Volume Information\SPP\OnlineMetadataCache are another file type that can provide information about shadow copies. You have pointed these out on your blog this past week. The GUID portion of the file name will match the GUID of the shadow copy set ID that you see when you run VSSadmin.exe. The file created date of the {GUID}_OnDiskSnapshotProp file will closely, but not exactly, match the date of the corresponding shadow copy. As shown below, examining the internals of a {GUID}_OnDiskSnapshotProp file will indicate the the date and time of a shadow copy within a few seconds to a minute, as well as the reason the shadow copy was created.
C:\System Volume Information\
-Syscache.hve
-Syscache.hve.LOG1
-Syscache.hve.LOG2
-tracking.log
-MountPointManagerRemoteDatabase
C:\System Volume Information\SPP\OnlineMetadataCache
*._OnDiskSnapshotProp
MORE INFO
https://www.hecfblog.com/2014/06/daily- ... inner.html
C:\System Volume Information\
-Syscache.hve
-Syscache.hve.LOG1
-Syscache.hve.LOG2
-tracking.log
-MountPointManagerRemoteDatabase
C:\System Volume Information\SPP\OnlineMetadataCache
*._OnDiskSnapshotProp
MORE INFO
https://www.hecfblog.com/2014/06/daily- ... inner.html
Re: MFT, USN Journal, $LogFile
Thank you for your suggestions. I've passed them to our developers.
Re: MFT, USN Journal, $LogFile
Any news?rwiper wrote: ↑Fri Oct 25, 2019 4:57 amR-TT Team, Please Do
Traces in MFT
Traces in USN Journal
Traces in $LogFile
Re: MFT, USN Journal, $LogFile
You may clean MFT traces by cleaning free drive space. The help page Wiping Free Disk Space explains how. You may clean either MFT traces alone or together with free disk space by selecting the What to wipe option.
We're going to implement the rest of requests in our future releases. We need some additional time to test them against possible system instability.
We're going to implement the rest of requests in our future releases. We need some additional time to test them against possible system instability.
Re: MFT, USN Journal, $LogFile
Thank you so much. I'm waiting. I love r-wipe so much.Alt wrote: ↑Mon Jan 20, 2020 9:18 amYou may clean MFT traces by cleaning free drive space. The help page Wiping Free Disk Space explains how. You may clean either MFT traces alone or together with free disk space by selecting the What to wipe option.
We're going to implement the rest of requests in our future releases. We need some additional time to test them against possible system instability.