NTFS Master File Table Record Removal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for deleting files in NTFS systems do not effectively remove file record segments from the Master File Table, leading to incomplete file removal and potential forensic recovery, and can impact system performance by fragmenting the file system.
Innovation Solution
A method and system that reads the boot sector, locates the Master File Table, loads and parses File Record Segments, and recursively overwrites sector-aligned offsets to ensure complete removal of file records, using direct API calls and sector-aligned offsets to securely delete files without fragmenting the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If conventional deletion methods are used to remove files, then the file icon is removed from user view, but the file record segments remain in the Master File Table allowing forensic recovery
Solution Approach 1:
The patent extracts and removes file record segments from the Master File Table separately from the actual file data deletion. The system identifies FRS entries in the $MFT and removes them to prevent forensic recovery, while the actual file sectors are handled separately through standard deletion or overwriting processes.
Solution Approach 2:
The patent performs preliminary removal of file record segments from the Master File Table before finalizing file deletion. By removing the FRS entries first, the system ensures that even if file data remains on sectors, forensic tools cannot locate or recover the files without the master table references.
2Reliability
If file record segments are removed from the Master File Table, then forensic recovery is prevented, but system performance may degrade due to fragmentation
Solution Approach 1:
The patent segments the file deletion process into distinct operations: removing file record segments from the Master File Table, and handling actual file data separately. This segmentation allows the system to maintain FRS removal for security while managing file sector allocation independently to minimize fragmentation impact on performance.
Solution Approach 2:
The patent discards file record segments from the Master File Table to prevent forensic recovery, and simultaneously recovers or reuses the associated file sectors for new allocations. This approach ensures both forensic security through FRS removal and system performance through efficient sector reuse.
3Loss of information
If existing deletion tools overwrite file data, then the file data is altered, but the file record segments and headers remain intact in the Master File Table
Solution Approach 1:
The patent extracts and removes file record segments from the Master File Table as a separate operation from file data overwriting. This ensures that even if file data is overwritten, the critical FRS entries that would allow forensic reconstruction are completely removed from the master table structure.
Solution Approach 2:
The patent performs preliminary removal of file record segments from the Master File Table before overwriting file data. This preliminary action ensures that the file's metadata and structure information are eliminated first, making subsequent data overwriting more effective for complete forensic security.
Data Source
AI summary
A system and method for removing Master File Table ($MFT) File Record Segments (FRS) from Microsoft's New Technology File System (NTFS) is described. In one embodiment, the present invention initializes the NTFS volume to detect the $MFT Physical Disk Address; then calculates total FRS to remove; in sequence initiates a loading algorithm while applying a $MFT fixup parameter; then parses the FRS via MFT_RECORD_HEADER structures; and in succession, executes an instructional writing parameter which triggers recursive logical programming instructions to remove the FRS's, using direct access at sector aligned FRS offsets.