Unused Space in Sector is Zeroed Out Under Windows NT

• Microsoft Windows NT operating system version 3.1

SUMMARY

When you create a new file, a certain amount of space is allocated for that file. Under Windows NT, if you do not use the entire space allocated, the file system returns zeros for the unused space. This prevents subsequent users from reading previously written and deleted data.

Under Windows NT, the file allocation table (FAT) structure actually fills such unused space with zeros. Unlike FAT systems, the high-performance file system (HPFS) and Windows NT file system (NTFS) keep track of how much valid data is actually in the file.

MORE INFORMATION

FAT Under MS-DOS

Under MS-DOS, when a file is written to a disk, a certain amount of space on a given sector may be unallocated. This is because the file size may be less than or greater than the size of a single sector. In this unallocated space, there could be pre-existing data marked as deleted that could be read and copied by intruders. This can be detrimental in enviroments that want to prevent old data from being extracted after it is supposedly deleted.

FAT Under Windows NT

Windows NT prevents access to old data fragments by masking old data bits with zeros. Thus, when a sector is read into memory, Windows NT replaces the old data bits with zeros and prevents any intruder from accessing this deleted data. This replacement is done in kernel mode.

NTFS and HPFS

Unlike FAT systems, HPFS and NTFS keep track of how much valid data is in a file. For example, if you create a 10 MB file and write 1 MB of data, HPFS and NTFS do not actually zero out the 9 MB of unused space (as the FAT system does), but are aware that this space is unavailable, and any disk read to the upper 9 MB returns all zeros.