Augeas
-
Posts
4,542 -
Joined
Posts posted by Augeas
-
-
The MFT contains entries for live and deleted files. If you tick Wipe MFT Entries then CC will count the number of deleted entries in the MFT, and create that amount of files with around (I think) 800 bytes of randomish data so that all the deleted file names and info are overwritten. You can look at these deleted entries using Recuva. Files under 1k are mostly held in the MFT entirely. Recuva can't, or won't, touch the MFT. So secure deletion will not work on these files. (But they are, as Ident points out, of no use to man or beast anyway.)
You can rerun CC with Wipe MFT enabled as often as you like. Those previously overwritten entries will be overwritten again.
Wipe Free Space is separate from WMFT as CC writes large files of zeroes over every free cluster it can find until the disk is full, then it deletes those files. Those large files can be seen and I believe secure deleted with Recuva, but it would be pointless to do that.
(This is more or less how CC and Recuva work, based on posts in this forum. Or so I think.)
-
Can you confirm that the drive is NTFS, as most flash drives are shipped as some variant of FAT to enable them to be accessed on multiple hosts. If it isn't NTFS then CC won't wipe the file names from the file tables.
If you're really concerned about leaving any trace of data on the drive then I would use one of the specialist disk cleaners such as Eraser: CC isn't a forensic cleaner.
I won't comment on cleaning the MFT until you've checked the file system on the drive.
-
I preserved my settings by adding google.co.uk to the cookies to keep list in CC, and it's OK in both FF and IE. Whether it'll work for you is another matter.
Google's becoming a pain with all these 'improvements'. That annoying wait on mouseover for the main page options to appear, the inability to select UK only unless you've already done a global search, the display of hundreds of images when you only wanted to look at a few, etc.
-
I've just done a Google images search and come up with the new layout, instead of 20 or so images per page you now get, I dunno, hundreds on one page. Then I did a close browser and CC normal clean. I then ran Recuva and could find no trace of the hundreds of images Google had presented. I did this on both IE and FF.
Ususally when you do a Google image search, a clean, and a Recuva run you see just about all of the thumbnails displayed. But not so far with the new layout. I haven't dug too deeply so far so I might find the answer soon.
They seem to be going into c:Documents and Settings/user/PrivacIE/Index.dat. No, I don't have private browsing enabled. This index file was around 9 mb and had an enormous amount of info in it. I've added it to the Include list and run a secure delete on it, which ran OK.
This topic should be in the CC discussion really. And this Index file should be cleaned by default.
-
I have no great opinion on creating a restore point after reg cleanup, I just have the Windows default daily point creation.
CC has the option of deleting any restore point, which means you can have 'before and after' restore points still existing and usable. To run a sys restore from (or to) a point before the deleted point Windows needs the info in the deleted point. CC will delete only the log entry for the point, making it inaccessible, whilst leaving the bulk of the backed up data for Windows to access should it be necessary. Thus you will get very little space freed after using CC to remove restore points.
-
I think that Jock means 'instead of the user having to close the browser down' etc. It is, or can be, a minor irritant.
-
There's no 'Immunize' function in CC. Where did you download CC from? It doesn't look as if you have the correct product. Can you post a screen shot of your CC window?
-
Try running a deep scan, which will probably run for hours. It is possible that several copies of the lost Excel files will be found, from edits and other operations. Recover them to the flash drive. They may not be up to date, but better than nothing.
If your friend has been gathering data over several years and not taken a backup then he is a rather foolish philatelist.
-
You will have to run a complete scan. In a normal scan Recuva reads the MFT to extract file names. I would think that it would have to do a sequential scan so it wouldn't be able to target a specific file name.
After the scan you can enter part or all of the file name in the File Name/Path box, which will filter the scan results so you can find your file more easily. You can also filter in this way before scanning, but Recuva will still do the full scan and just show the filtered results.
-
You already have that. Select Options/Actions/Restore Folder Structure. You can then right click in the display panel and select View Mode/Tree View, and pick whatever folder you want to restore. Whether you will be able to do this after a format is anyone's guess.
-
For a start (and as you rightly comment in another post), Recuva is a piece of software trying to determine whether a file is intact (recoverable) or not. I don't know what criteria it uses, apart from the obvious such as being overwritten, but it doen't always get it right.
Secondly, unrecoverable doesn't mean that you cant recover any data. It means that the data is not recoverable in it's original virgo intacta form, but presumably that was too long to fit in the column header. Anything Recuva points to, with a length greater then zero, can be recovered. It may well be rubbish, but that's how it is. If the data has been overwritten what you're recovering is the overwriting data, which might indeed be data from another live file.
If Recuva can't overwrite a deleted file it may be that it resides entirely in the MFT, has been overwritten by another live file, or that space is locked for some other unfathomable Windows reason.
I'm not too sure what you mean by overwritten by the same file. I guess it is possible that you create xxx, delete it, then create it again and another MFT entry is used but the data put into the same clusters as before.
-
Without running deep scan, you're looking at entries in the MFT. The only file type I know shown by Recuva with unknown date and size is, or are, deleted email files. These would have a filename with a zip extension. These are created dynamically and can't be securely deleted or defragged or anything.
Why do you think they are really old?
If they're not email files then:
If you want to get rid of the entry in the MFT (so you won't see this file name again) then you could create enough new files to overwrite the entries. If you don't run CC for a while, and you don't have hundreds of thousands of file entries in the MFT, and you do something like a Windows patch/upgrade, then these entries will eventually be overwritten. Justr keep your eye on them until they are.
Alternatively you could use the Wipe MFT option in CC. You will need to have Wipe Free Space enabled also I believe. Some users (one, at least) select this option and when the Wipe MFT has finished, cancel the Wipe Free Space. I don't do any of this so be it upon your own head, as they say.
The file left on disk will eventually be overwritten, or not, but it isn't really important. Or you can let Wipe Free Space run to its more or less useless conclusion.
It isn't cluster tips by the way, or my name isn't what it is, and it is.
-
Windows, as well as all other operating systems, doesn't make a difference between free space holding a previously deleted file, and free space with only zeroes.
That's because there is no difference. WFS will allocate files large enough to overwrite all free space on a disk, whether that free space contained old deleted file data, or whether it had never been written on before. These files contain binary zeroes. When the disk is full the files are deleted. The end result is that a portion of the disk contains live files with live data, and all other space on the disk contains deleted files which had zeroes as data.
If your life has absolutely no meaning you could, I suppose, do the equivalent of WFS by copying all your dvds to your hard drive until the disk is full, and then delete the lot. Personally that's not for me.
-
Ah, maybe I missed out a few words here and there. Microsoft can say it far better then I can...
'Windows Vista and Windows Server 2008 use a default size of 200MB for the initial MFT zone reservation. As the MFT outgrows the default zone due to more files being added to the volume, the MFT will create another 200MB zone to grow into. This change to fixed amount versus a percentage was done to deal with increasing size of volumes and create better efficiencies.'
And also...
'For workstation or server profiles that have large MFT?s, it is possible that the MFT will be more ?fragmented? however these fragments will be 200MB in size a piece so the performance impact will be negligible.'
-
A copy of the deleted file is created on your hard drive in the folder of your choice. The deleted file remains on the disk untouched and can still be seen using Recuva. You will therefore have two copies of the file. You can overwrite the deleted file with Recuva's secure delete option, should you so wish.
-
I believe that from Vista on the MFT is allocated in 200k blocks as required, and there is no pre-specified MFT Zone as there is XP. You can defrag these blocks by making them contiguous but to no great advantage.
-
Strange, Vogon/Ontrack actually sell a software data eraser tool. And on their website is this.....
'Physically destroying the hard drive is the best way to make sure the data is gone for good. Fortunately, there are other safe ways to ensure data is securely erased. Data-erasing software products will overwrite data, with a single pass usually being sufficient. Military norms, however, require that a drive be overwritten several times. In these circumstances, even Ontrack's data recovery engineers would be unable to recover useful data. The cost to attempt such a recovery would also be tremendous.'
There's nothing I can find on Vogon's site that indicates that they can recover data from overwritten sectors at any cost
The O/P's post is stating nothing new, as he says CC isn't, and has never claimed to be, a secure data eraser.
-
Just one pass of zeroes, I believe. The secure file deletion methods apply to files, not wfs.
-
I guess not, as XP is the last Windows Op Sys to use an MFT zone. In NTFS under Vista, and presumably Win7 too, the MFT is designed to be fragmented in (I think) 200 mb chunks. Microsoft says that users won't notice one or two fragments, and they're probably correct.
The MFT Zone is probably the fruit of a very keen developer's mind, a clever solution to a problem that wasn't really there in the first place.
-
Cleaning is done ONLY ONCE.
... it deletes to recycle bin to be held pending till tomorrow.
... you defer till tomorrow the joy of seeing free space increase by that action.
That looks like two runs to me. You would always have to run CC once more to remove the current run's data. Try telling that - endlessly - to new users.
Holding on to deleted data for just one day, or even less, is mostly pointless (which, as with the recycler size limit, you didn't respond to).
I think that this would just be a complex morass.
-
In the spirit of friendly criticism, I'm not with this one.
I use my recycler rarely (usually stuff gets a shift/del), but anything I send to the recycler I want to keep for a while. A few weeks, or even longer. This would wipe stuff I wanted to hold on to.
It would depend on users running CC twice, or forever really. One-time users would see no improvement.
Those one-time, or first-time, users would be posting here that running CC gives no free space.
There is a recycler size limit, 10% of disk size in XP. What happens to those who clean more than that limit?
If you run CC every day, as some do, then this option is just more work for no advantage, unless the deletions are cumulative!
How would you differentiate between stuff CC puts in the recycyler and other recycler stuff?
Most problems with CC seem to be caused by enthusiastic registry cleaning.
Hardly any problems are caused by the default Cleaner settings.
-
The usual advice with a corrupted file system is to select the Recuva option of Scan for Non-Deleted Files. However if you can't see the disk in Recuva then that's not a lot of help.
I don't know what you would use to copy data to a new disk at cluster level. Considering that there are 25,000,000 4k clusters in 100 gb then this must go in the category of thankless tasks.
I don't know if there's any mileage in formatting the disk. This does not overwrite the old data, apart from the system files. You then should be able to see the disk in Recuva and run with both Deep Scan and Scan for non-deleted file selected. You really need a second opinion before dashing away to do this.
-
My pc is slow to show CCe sys restore info, but only in seconds.
It seems that I have 14 points, being the last 14 taken. I'll keep an eye on the list to see if the oldest one goes as a new point is created. The Avast 5 info posted in the link doesn't seem to be specific to my case.
I quite like having 14 points. If I were asked how many I wanted to keep then 14 would be a reasonable answer, far better than my usual 50-odd. I'm just curious what's doing this.
-
Do you use Wipe Free Space?
Ha! You should know me better - never. Nor do I use CC on the Recycler. I rarely use the Recycler at all.
You say you only have one disc, does it have more than one partition, and is system restore set up to monitor them as well as the C drive?One partition.
Any new software around the last few weeks?
No. DVD Decrypter on 7/4/10 was the latest.
What av do you use?
Avast! 5.
Anything unusual in Windows Event Viewer regarding system restore?
Heven't looked. I've just looked, nothing suspicious.
Does your pc have enough 'idle time' to create a system restore point (eg you don't have something running in the background all the time now)
Plenty.
Is your system date and time correct?
Yes.
And I have over 140 gb free.
Deleting folders
in Recuva
Posted
Yes. CC overwrites all space on the disk not occupied by live (user and system) files. More or less. It's all in http://docs.piriform.com/