Jump to content

Augeas

Moderators
  • Posts

    4,542
  • Joined

Posts posted by Augeas

  1. How do you overwrite emails.zip? You can't, the file is only used to recover emails. There is nothing to overwrite.

     

    Come si fa a sovrascrivere emails.zip? Non ? possibile, il file viene utilizzata solo per recuperare i email. Non c'? niente da sovrascrivere.

  2. The last question mark is part of the question, not the path name.

     

    I've just run Recuva and it shows quite a few entries with the path as C:\?\Cache\ - something I've never seen, or noticed, before. They are the usual selection of temp internet files. This morning I powered up and ran Recuva and I didn't notice the cache path then. Oh yes, we had a power cut this morning. The temp internet files shown in the cache path are FF files, well the pics are, not necessarily from today. Could this be to do with the power cut?

     

    My FF cache folder in ....\Mozilla\Firefox\Profiles\clgzbh99.default has a create date of today and time of around the power cut. It only has today's stuff in it. In fact I can't access anything using FF offline that was browsed before the power cut. I'm guessing that the power cut made FF throw away its cache.

  3. I don't have a floppy but here goes:

     

    I don't think it's a CC fault. I used to have a floppy on my old pc and it too clattered on occasion, startup etc. I stopped this by altering the boot sequence in the bios from a;c;scsi to c, and boot up floppy seek to disable. Maybe there's something there that can stop the a drive being searched by default.

  4. I understand that the file is a 'virtual' file and is only created when you chose to recover the emails. It can't be deleted by Recuva. You could try compacting your email folders to get rid of deleted emails, and then wipe free space if you're really paranoid.

  5. You could do a Recuva normal scan and then sort in size order to see if you can find it under another name. Any recovery of course must be to another drive or partition.

     

    It's probably that the entry for the file in the MFT has gone. You could run Recuva in deep scan mode, which will take much longer, and then sort by filename or size.

     

    The big problem is that the file is huge, and the likleyhood of some part of it being overwritten is probably huge too, so a recovery might not be successful. The daily Windows restore point could pinch some space, as could a/v auto-updates, and the prefetch file if you've just downloaded Recuva, and Recuva itself, and various logs etc that I can't think of and don't know about. You could disable sys restore and disconnect from the internet to minimise this risk. Just do as little as possible on this drive.

     

    I don't think your chances of recovery are good, but give it a go.

    • *.* pattern is added, this should be just * to include files without an extension

    It already does. Include those files, I mean.

     

    • The parent folder should itself be deleted, having an empty directory is pointless

    Not for all of us, old bean. I use a custom folder called crap into which I throw stuff to be deleted (usually secureley deleted) by CC. I don't want the folder to go. I don't particularly want the other included folders to go either.

     

    But if you do want the folder to go, then just manually edit the included folder name to remove the *.* - works a treat.

  6. It's a stand-alone box underneath the Wipe Free Space box that lists the drives you have. At least it is on my pc. I've no idea why you don't appear to have this box, unless you're running an O/S that doesn't use NTFS. An older laptop using FAT32, perhaps?

     

    Later edit - I've tested this and XP on a FAT file system still shows the Wipe MFT box, so that theory's out of the window.

  7. No great suggestions, but this isn't - in my experience - normal CC behaviour. CC doesn't modify files.

     

    Ashdown had problems with malware, are you sure you're not infected, especially that your ccleaner.exe isn't infected? What's the last mod date of ccleaner.exe? Is it later than the installation date? I would copy the CC folder to a usb drive under a new name (cc bad etc) for future examination and delete the folder on your hard drive.

     

    About a year ago I had a nasty virus that inserted its code into exe files. When I ran an exe, which I did, it destroyed my pc. You don't seem to be having such devastating behaviour, but it could be an infection of some sort. By the way my virus just flew past AVG, which is why I changed to Avast, which did detect it.

     

    I should do a full virus scan. You could post this topic in the Spyware Hell forum where it will receive the attention of more knowledgable people than me.

     

    What happens if you rename the extension of a known file to its proper ext? Can you open the file then?

     

     

    Good find, Hazel (below). There's nothing like being in the dark.

  8. <if you mean by looking at the Applications tab in task manager> You should be looking in the Processes panel, you can click on Image Name to get them in alpha order.

     

    <the error i always get says that i must close the firefox program that is still running, or conversely, that i must restart> Although I don't have Chrome I do have FF, and the close browser message from CC never says you must restart. Is this a CC message?

     

    From your long missive you may well have a bug, but probably not in CC.

  9. They seem to be mainly, if not totally, temp internet files. I wonder if the directory structure is lost or unobtainable when this is emptied?

     

    I'm in the spare room, by the way. Where are you?

  10. 1) No to both parts. Actually the first part was illogical, Jim.

    2) I doubt that hackers would be in the slightest bit interested in unused file extensions.

     

    And the final answer is that this is the whole point of CC, removing unwanted and unnecessary elements.

  11. It's all Sunday afternoon TV's fault. I have never until today run the Gutmann 35 pass secure deletion method, but idle fingers, etc.

     

    In Recuva I set the deletion method to Gutmann 35 pass. I ran a scan, and chose a file which had no overwritten clusters. I ran secure delete against it. In the header display of the first 128 bytes were hex zeroes. I am assuming that the rest of the file is the same.

     

    Now I tried this (separately) on a 3 kb, a 4 kb and a 29 kb file. All did the overwrite as quickly as a normal one-pass would do, as far as I could tell. These aren't large files, but 35 writes of 29k is over 1 mb. Not a lot to overwrite in one go, but a lot of writes if the write cache were flushed after every pass to force each write to disk.

     

    Secondly all the files ended up filled with hex zeroes. But the Gutmann method starts and ends with four passes of random data, and only one pass, the tenth, is hex zeroes.

     

    I don't really mind, or care, whether the Gutmann method is being used or not, as I shall revert to normal one-pass deletion once again. But it is interesting, no? No?

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.