Jump to content

Augeas

Moderators
  • Posts

    4,542
  • Joined

Everything posted by Augeas

  1. I am not confused. Thank you for your compliments, who knows whether CC commits to disk? I would say that it does. Misinterpreting on purpose? The phrase 'SSds were built with many writes to the MFT in mind' certainly implies some constructional abilities. It's actually nonsense, as it's NAND flash that holds the MFT (and all other files) and is either robust or not. On reflection I think you may mean robust in a software sense, and that is entirely down to the file system, in this case NTFS. The SSD knows nothing of the MFT and just doesn't come into it. I'm not going to get drawn into this discussion, and your strawman arguments about fake chips. SSDs last a long time, and that's that. True, you didn't. But this thread is entitled Using CCleaner on SSDs, and it's in a CC forum on a Piriform Bulletin Board, so one might be forgiven for thinking such. You may not believe what I say, but it is frustrating repeating myself. I would suggest that you re-read this thread and perhaps also re-read some of the relevant passages in the previous link (it can be heavy going to tackle all at once). SSDs are far more complex, and different, than many users realise.
  2. It would be better for both brevity and comprehension if if HDDs were left out of this thread, as the title refers to SSDs. I said that CC will fill the disk, not write and delete files one by one. However, as described in detail in the link, zero-byte pages are maped to a default zero-byte page, the SSD doesn't write millions of zero-filled pages. Writing random data certainly will fill the addressable pages on the disk, and deleting them will return to the default zero-filled page mapping, just as you were if you hadn't bothered to do all that in the first place. The MFT is a file just like all the others. It has no special longevity attributes and is unknown by the SSD controller. If Drive Wiper is used then the MFT is wiped as you require. It is not made larger, or for that matter made smaller, in this process. It is not possible to access deleted pages nor the overprovisioning pages on an SSD using non-specialist software running under Windows (and I don't know of any specialist s/w either). If the chips are read in a lab the data is almost certainly encrypted or striped across blocks, and there is no link from one page of a file to another. No financial business or organization that might have sensitive data would use a free utility with no authentication or verification for disk sanitisation, and CC, despite what some of its marketing might claim, isn't intended for that purpose. The SSD life section is a little tongue in cheek. Of course some electronic devices will fail immediately, some will last seemingly forever. An approximation of the life of NAND flash can be made, and it is a very long time. .I have a 512 mb flash drive dating back to 2006 that has been thrashed unmercifully, and it's still good, if semi-retired now.
  3. It is effectively random, as the existing data has been randomised before writing, and the overwriting pattern of zeroes is also randomised, so there is no concept of overwriting a one with a zero etc as many think (at least not in the last 30 years).
  4. To answer your question CC will, if you absoultely force it to, fill the disk with zero-filled files, and then delete them. However CC will warn against this, and indeed it is utterly pointless, achieves nothing, and will hammer the MFT and other system files. It does not even 'fill' the device. It is not, as you imply, 'the ONLY way to "erase" anything from solid state memories'. There is no way, using O/S software. TRIM will do it all for you. There's a lot here that is shall we say contentious, but I'm not going to get into a lengthy exposition. If you want you could read through http://kcall.co.uk/ssd/index.html which goes into considerable detail, even though it is still being updated. You could swap ssd for ntfs in the url for even more bed time reading.
  5. On the SSD the clusters will be mapped to a zero-filled page on delete with TRIM, so you will be recovering zeroes. There's not enough info on the attached USB drive to make a guess.
  6. It's been suggested a few times before, and although there is a likelyhood that some file will be modified or unavailable on a restart, that also applies to a certain extent when running Recuva anyway. I doubt if will be implemented, given how many times Recuva has been updated recently (around zero). I can't see any real reason why you should not work on your system drive whilst running Recuva. It will slow things down a bit but I'm sure you can live with that.
  7. Well, I can't open my files is pretty unspecific, and we're not clairvoyant. At a guess I would say that the files do not contain a correctly formatted header. Recuva copies clusters bit by bit with no alterations, so what's recovered is what's on the source disk. The reasons why the header is not what is expected could well be found in the somewhat slighted file (which saves typing it out every time we get this question). But I'm no expert.
  8. Read through this, the answer might be in there. http://kcall.co.uk/recovering files.html
  9. In advanced mode open Options/Actions and check boxes 1, 2, 3 and 5. Do not apply any filter to the search.
  10. You can put whatever extension you wish in the File Name/Path box, e.g. *.mp4
  11. That facility isn't available. You could filter by Video, which should drop some of the chaff.
  12. You're not doing anything wrong. With TRIM, which I would expect most O/S and drives have now, deleted clusters on an SSD are immediately mapped to a default zeroed cluster. The deleted data cannot be recovered by any means. Recuva will find the deleted file names and cluster addresses in the MFT, but the data has gone forever. If you look at the Recuva Info pane in Advanced Mode then the headers will contain zeroes. Unfortunately nothing and no-one can retrieve it.
  13. Augeas

    lost files

    Oh I dunno, you could always put .txt in the Filename/Path box (in advanced mode).
  14. Augeas

    lost files

    Deep scan will not find text files as they do not have a file signature thus the scan can't identify them as files. A normal scan (which runs before the deep scan) can find them (if the MFT record still exists) as it scans the MFT and the MFT holds the file name and cluster addresses of all files on the drive. If the text files aren't being picked up by the normal scan then there's little hope of retrieving them.
  15. None of us would be so fooish to wipe free space on an SSD, would we? We don't really know the mechanics of wiping free space (CC's mechanics) but we're pretty sure it allocates a large enough file to fill the disk and then deletes it. How is that file allocated? I would hope in big chunks for a start, but CC's code dates back to cro-magnon times so we can't really be sure. If it allocates initially in 1 gb chunks then the MFT record will very soon be full, and an extension record allocated. And another, and another, and then an index record, holding all the addresses of all the MFT records. The MFT record(s) for such a file could be horrendous. As the disk fills smaller allocations would be necessary, to grab the smaller spaces. More MFT mayhem. I think that the optimun conditions for a WFS would be if the free space is defragged first. Then the big file allocation would be eased, big chunks would do most of it. Small free spaces can, as I know, be missed by WFS. The process seems to allocate in minimum 32k or so chunks. P.S. Are you running WFS in Options/Settings or Drive Wiper? If in Options did you check Wipe MFT?
  16. In Advanced Mode select Options/Actions, check Restore Folder Structure. If a ? appears in a path then the folder info is missing and the path can't be completed.
  17. The MFT record for a folder contains the addresses of the MFT records of all the files in the folder. The MFT record for a file contains the address of the owning folder. When a folder is deleted NTFS removes the addresses of the files. Recuva reads the folder address in a file's MFT record to locate the owning folder, chaining back all the way to the root (if the chain is still extant). If a ? is shown as a folder it means that the backwards chain to the root cannot be completed, probably because the MFT record for that folder has been overwritten. Nobody knows whether you can recover 'this file' with Recuva or any software, we don't even know its name. Judging by what's been done to the drive I would doubt it, as I've said twice before.
  18. It appears to have located a folder. Recuva doesn't list folders explicitly, but lists files and then builds up the folder structure (if required and requested) in a chain-back process. Deleted folders, as far as I can establish, are cleared of their list of files by NTFS, so finding a deleted folder is of little use, it's just a name. You are of course free to use whatever software you want to aid any file recovery.
  19. Augeas

    Ignored Files

    By default Recuva will ignore non-deleted, system and zero-length files.
  20. The first image shows no file system, the second shows NTFS. The odds of recovering a huge file after a partition and format are about the same as England winning a test match.
  21. Simple cleaning appeared recently. I decided to use it, but I did not think that after that all accounts and the history of visited sites would be cleared. I am very upset, now I will again have to recover all logins and passwords for autocomplete. When using simple cleaning, I did not see a single indication of such consequences, it was not indicated what would be cleaned when using it. I suggest you display a warning about clearing browsers data.
  22. Where did you read that? It is nonsense, Recuva reads files only. What was the state of the external drive? Why were you recovering files? How large is it? Were you running a deep scan? You can't see what Recuva is finding until it has finished the scan. How could you see files if it was 'almost done'? Do you mean scanning or recovering?
  23. How were they erased? It's rather a lot to lose by accident.
  24. That's a different drive, or at least in a different state. The first screenshot doesn't look as if a file system has been found. I'm not really sure what you are doing.
  25. That's a folder not a file. Perhaps you haven't checked Show Files in Hidden System Directories. To reverse a partition delete and format you need a time machine. I don't know what the other sw does (or even what Recuva does), but the file names and path are all held in the MFT. I guess after a format that you're looking at the remnants of the old MFT that weren't overwritten. I should display the results as a List and sort on folder name (after doing the check and rescan as above).
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.