Moo0 Anti-Recovery: free program that erases recoverable data in unused disk areas

Discussion in 'privacy technology' started by MrBrian, Sep 29, 2011.

Thread Status:
Not open for further replies.
  1. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
  2. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,516
    Never heard of it before, thanks.
     
  3. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    You're welcome :).

    Note in FAQ:
     
  4. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I did some tests with Moo0 Anti-Recovery v1.05, Recuva v1.40.525, Disk Investigator, and NTFSWalker. The tests were done in a Windows 7 x64 virtual machine. I copied some .pdf files to the virtual hard disk and then deleted them in Explorer using Shift+Delete.

    Test #1: Erased file name traces and empty parts of MFT with Moo0 Anti-Recovery. Used Recuva without Deep Scan and also NTFSWalker. All deleted MFT entries, except for a few, were overwritten with random-looking data. I consider this a passed test.

    Test #2: Used Recuva's Deep Scan to list which files could be recovered by data carving. Some of the deleted .pdf files were found and successfully recovered to a separate partition. Used Moo0 Anti-Recovery to wipe free space. Used Recuva's Deep Scan to list which files could be recovered by data carving. None of the deleted .pdfs were found. Used Disk Investigator to briefly examine various sectors; unused sectors appeared to be filled with random-looking data, instead of the numerous 0's before the free space wipe. I consider this a passed test.

    Test #3: Wiped cluster tips with Moo0 Anti-Recovery. Used Disk Investigator to inspect cluster tips of some files. Some cluster tips were filled with all 0's (including a test file whose cluster tip wasn't filled with all 0's before wiping the cluster tips), while other cluster tips were partially filled with 0's, and then some non 0's. I believe this is a bug and have informed Moo0. I consider this a partially failed test.
     
  5. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    Have you ever run these tests with R-wipe or Eraser?
     
  6. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I probably did with Eraser awhile ago, but I don't recall the exact details.
     
  7. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I just did similar tests with Heidi Eraser v6.0.8.2273. It did well in all the tests. It does require admin rights to do its work, unlike Prevent Restore.
     
  8. caspian

    caspian Registered Member

    Joined:
    Jun 17, 2007
    Posts:
    2,301
    Location:
    Oz
    Thanks for that.
     
  9. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    You're welcome :).
     
Loading...
Thread Status:
Not open for further replies.