1
SCHOOL OF COMPUTING
MSc Cyber Security and Forensic Science
────────────────────────────────────────────────────
Forensic Analysis of Secure File Deletion Tools on the NTFS File System
────────────────────────────────────────────────────
Submitted by:
Student’s Name
MSc Cyber Security and Forensic Science | 2026
A dissertation submitted in partial fulfilment of the requirements
for the degree of Master of Science
School of Computing | 2026
, 2
ABSTRACT
NTFS silently stores metadata for deleted files even after they are deleted. This paper will test
the hypothesis that three widely used secure deletion software products, including Eraser,
BleachBit, and Secure Eraser, can indeed eliminate all traces of forensic evidence stored on an
NTFS-formatted hard drive. It was tested in a VMware virtual machine with Windows 10. The
disk was viewable after every deletion with Autopsy and FTK Imager. The wipe command
successfully cleared file content in all three tools. Nonetheless, none of them cleared the Master
File Table, the record of transactions, or the directory indices, where the names of files, times,
and the history of file deletion remained intact. The results are directly applicable to forensic
investigators, organisations that must comply with the UK GDPR, and individuals who use these
tools to achieve real privacy.
Keywords: NTFS, secure file deletion, digital forensics, Master File Table, data recovery,
Eraser, BleachBit, Secure Eraser, Autopsy
, 3
ACKNOWLEDGEMENTS
, 4
Table of Contents
1.1 Background............................................................................................................................7
1.2 Problem Statement.................................................................................................................7
1.3 Research Objectives...............................................................................................................8
1.4 Significance of the Study.......................................................................................................9
1.5 Scope and Limitations............................................................................................................9
2.0 Literature Review.................................................................................................................10
2.1 NTFS Design and Analysis..................................................................................................10
2.2 Logging in the NTFS File System.......................................................................................11
2.3 Secure Deletion Algorithms.................................................................................................11
2.4 Characteristics of Secure Deletion Software.......................................................................12
2.5 Challenges of Secure Deletion Tools with NTFS................................................................12
2.6 Forensic Recovery Techniques............................................................................................13
2.7 Critical Analysis and Research Gap....................................................................................13
Chapter 3: Project Management.....................................................................................................15
3.1 Research Approach..............................................................................................................15
3.2 Scope and Schedule.............................................................................................................15
3.3 Resources.............................................................................................................................16
3.4 Risk Management................................................................................................................17
3.5 Ethics and Legal Compliance..............................................................................................18
3.6 Quality Assurance................................................................................................................18
Chapter 4: Methodology................................................................................................................19
4.1 Research Design...................................................................................................................20
SCHOOL OF COMPUTING
MSc Cyber Security and Forensic Science
────────────────────────────────────────────────────
Forensic Analysis of Secure File Deletion Tools on the NTFS File System
────────────────────────────────────────────────────
Submitted by:
Student’s Name
MSc Cyber Security and Forensic Science | 2026
A dissertation submitted in partial fulfilment of the requirements
for the degree of Master of Science
School of Computing | 2026
, 2
ABSTRACT
NTFS silently stores metadata for deleted files even after they are deleted. This paper will test
the hypothesis that three widely used secure deletion software products, including Eraser,
BleachBit, and Secure Eraser, can indeed eliminate all traces of forensic evidence stored on an
NTFS-formatted hard drive. It was tested in a VMware virtual machine with Windows 10. The
disk was viewable after every deletion with Autopsy and FTK Imager. The wipe command
successfully cleared file content in all three tools. Nonetheless, none of them cleared the Master
File Table, the record of transactions, or the directory indices, where the names of files, times,
and the history of file deletion remained intact. The results are directly applicable to forensic
investigators, organisations that must comply with the UK GDPR, and individuals who use these
tools to achieve real privacy.
Keywords: NTFS, secure file deletion, digital forensics, Master File Table, data recovery,
Eraser, BleachBit, Secure Eraser, Autopsy
, 3
ACKNOWLEDGEMENTS
, 4
Table of Contents
1.1 Background............................................................................................................................7
1.2 Problem Statement.................................................................................................................7
1.3 Research Objectives...............................................................................................................8
1.4 Significance of the Study.......................................................................................................9
1.5 Scope and Limitations............................................................................................................9
2.0 Literature Review.................................................................................................................10
2.1 NTFS Design and Analysis..................................................................................................10
2.2 Logging in the NTFS File System.......................................................................................11
2.3 Secure Deletion Algorithms.................................................................................................11
2.4 Characteristics of Secure Deletion Software.......................................................................12
2.5 Challenges of Secure Deletion Tools with NTFS................................................................12
2.6 Forensic Recovery Techniques............................................................................................13
2.7 Critical Analysis and Research Gap....................................................................................13
Chapter 3: Project Management.....................................................................................................15
3.1 Research Approach..............................................................................................................15
3.2 Scope and Schedule.............................................................................................................15
3.3 Resources.............................................................................................................................16
3.4 Risk Management................................................................................................................17
3.5 Ethics and Legal Compliance..............................................................................................18
3.6 Quality Assurance................................................................................................................18
Chapter 4: Methodology................................................................................................................19
4.1 Research Design...................................................................................................................20
