Jump to content

Augeas

Moderators
  • Posts

    4,542
  • Joined

Posts posted by Augeas

  1. Sometimes it's best to sweep the whole house clean, with the new broom, as the mangled metaphor goes.

     

    Do not touch the Registry section, you will not gain a great deal and my well mangle more than your metaphor, so keep away for the time being.

     

    Run CCleaner - the Window brought up when you press the Brush icon on the top l/h of the page - with the default settings. You can run the Analyse step first if you wish or just go ahead and press Run Cleaner. There will be a warning of dire consequences but just bash on.

     

    This will remove all of your cookies. Unfortunately this may also remove some saved info, such as some logon id's and passwords. When you next logon to a site and wish to save the logon info, press remember password. Then go to CC's Cookies list and move the cookie for that site from the by now smaller list to the cookies to keep list. It may take a little practice and a few goes, but it's all added skills and knowledge.

     

    When you've clicked and pressed enough come back here with a progress report, for marks out of 10.

  2. Alan, the default with no backup prompt is not to take a registry backup. This option is I guess for those with either supreme confidence or supreme belief in CC's competence. I'm neither, so I backup.

     

    I've always had the message to close FF during analysis and run of CC, so why are you only getting it now (unless you always closed FF previously - too much of a coincidence)?

     

    Cheers.

     

    PS Keith - Today you will become a Power Member! Or maybe tomorrow....

     

    PPS It was today!

  3. Yes, it will, or should do. Plug the thing in but don't do any additional work on that drive at all. Install Recuva on the C drive, open it and select the portable drive from the drop-down list, and run Recuva in normal mode. You can sort the results by size, date, name, path etc, or by entering a filename in the top r/h box. When and if you find anything recover it to the c drive, not the portable drive. If you don't have any joy then post here again.

     

    It's hard to see how several copies of a file disappeared 'all at once', but an occasional backup to a cd or dvd is a good idea for really important files.

  4. No problem, old bean. Ags should have been able to work it out him/herself anyway. That's the problem with these meals, a small glass or two of digestive assistance tends to keel me over for some reason.

  5. CC will overwrite and permanently remove from prying eyes the data the file entry in the MFT is currently pointing to. It might, however, be possible to recover the data and the perhaps the entire file from other fragments left from previous edits, or in the page/hiber/sysrecovery/autobackup files, etc.

  6. That won't work, only by chance anyway. Fr'instance, if you uncheck Option a and the correct option is C, and then run CC, you will get the dreaded false positive as C will be doing the wiping. Maybe you mean uncheck all options, then check one option at a time until the Hedge Funds entry is gone.

     

    Or more simply, right click on each option in turn and select the Clean ....etc option. This will execute each option separately so that when Hedge Funds goes you have your man. Or woman, as you please. You can leave all your options ticked without upsetting anything.

     

    Have fun.

  7. To get a silly question out of the way, you do have some options ticked? (Although CC does not usually remove options on install.)

     

    I too have never known this before. Is it just the CC scan that shows no results, or is it Reg scan, or everything?

     

    I should try a fresh download from Piriform's site and reinstall.

  8. If they are not on the c drive (in other words, the folder you want to delete is a sub-folder):

     

    Go to Options/Include, Select Add Folder, add the folder you want deleting. When you have added the folder to CC's list, right click on the folder name and select Manual Edit. Remove the \*.* from the end of the folder name and save. Now run the Custom Files and Folders part of CC. The folder and its contents, if there are any, will be removed (the folder is not shown on Analyse, but still goes to folder heaven).

     

    I suggest you test this on a safe folder, as I have just done. I would be a little cagey about deleting a sub-folder in c:\Windows, so do it at your own risk.

  9. Hi Vince,

     

    Right. Do a scan with Recuva. Pick a harmless file, right click on it and select Secure delete Highlighted. There will be a Do You Really Want to do This box, select yes, and there will (should) be a Deleted 1 Files in 0.0x sec message.

     

    If you don't get this message then either you have highlighted one file with left click, or several with left click/shift, and then right clicked when the mouse is not over the highlighted area. The box will say Do You Really Want to Delete 0 Files, and indeed will not delete anything. Using the tick boxes instead of highlighting will solve this.

     

    If the files are small (1k) they may be resident in the MFT, in which case you can go through the motions but the final message will include Not deleted - File is resident in the MFT.

     

    You can not of course securely delete an undeleted file, if you have chosen to show these in your scan.

     

    Other mysteries are when the deleted file has already been overwritten, sometimes with a pic, so that it shows the pic that's overwriting it. You can secure delete the file, but it will still show the overwriting pic, as that is a live pic and won't be touched. However this won't be the cause of your 0 Files deleted message.

     

    That's about all I can think of at the moment. Champagne and orange juice awaits me (OK, Cava and oj, we're not that rich), so I'm off to indulge. Happy Christmas everyone, especially you insomniac Americans.

  10. I know this is of no help but if they are commercial customers then where is their backup/recovery strategy?

     

    You could try a deep scan, but with this amount of data then it may take until Boxing Day to run and it won't, as far as I know, restore the directory structure. You may be left with an enourmous amount of files to recover and sort into folders.

     

    I have a fear that as a 'customer' then the pc will still be in use: this is bad news, it should be - in the best of all worlds - in quarrantine and not being rebooted or used for any purpose. Run Recuva from a flash drive if it's not already installed on the pc and recover any files to a separate media, flash or another hd. Have you recovered any files already, and if so where to?

     

    Good luck.

  11. One of the settings in Recuva asks you to select which method you wish to use to overwrite (delete) the original files on the original drive. It doesn?t appear to give you an option not to overwrite (delete).

    I don't wish to be rude at all, but just don't use this option. I'm puzzled why you should click on Secure Delete when you're trying to recover files. Secure Delete will securely delete files. Recover File is the option to recover files. There is no automatic deletion in Recuva.

     

    I guess the files I was trying to recover from the original drive were damaged as I had not deleted them. They had simply disappeared from the sub directory they were in.

    In your original post you said you were trying to recover undeleted files. Were you, or were you trying to recover files that had been inadvertently deleted?

     

    I was copying a bunch of large MPG?s from one computer to be used with another. I copied these into this sub directory which also had other sub directories within it. All the files which I had copied into this sub directory along with the other sub directories had just disappeared. Before I disconnected the USB dive from the original XP, I verified all the files and sub directories were in tack. I then shut down the computer and disconnected the drive. When I plugged the drive into the other computer, all the files within the subdirectory were missing.

    Were you copying files to a flash drive? Were you copying files or using Recuva to recover deleted files? Did you disconnect the flsh drive properly before closing down your pc? What's the capacity of your flash drive?

     

    So I ran Recuva and it found the missing files and indicated that they had not be deleted or overwritten. After Recuva recovered whatever files it would, I tried getting it to recover all the same files again to another USB drive.

    Did you run recuva on the flash drive or the hard drive? I'm getting an attack of drive confusion now.

     

    It was then that I discovered that one of the features of Recuva was that it overwrites (deletes) the recovered files from the original drive.

    It isn't, honestly.

  12. Yes, I had a look at this when you posted earlier. It seems that the complaint is, or used to be, when securely deleting the recyler under Vista. The deleted filename structre under Vista is different from XP so this might have been the reason. I've not come across this myself as I use neither the recycler nor Vista, but I vaguely remember some posts a little while ago. Still, it appears to be fixed, and in far less time than two years, so go ahead.

     

    The secure delete option has never, as far as I know, been promoted as a forensic cleaner (for want of a better phrase), and it clearly isn't. But it's fine for most users, and stops embarrassing pics of Shaun the Sheep popping up when your curious offspring press the Recuva icon.

     

    It's almost impossible to hide completely either data, traces of data, or where you've been on a pc unless you completely overwrite the entire disk with a dos-type application and then reinstall Windows. Or hammer the disk to a pulp and then install a new one. Even then if you've been a really bad boy your ISP can provide evidence of your surfing and downloading activity from years back.

  13. It always did. CC overwrites the data in the file, and that cannot be recovered full blooming stop. However a file can possibly be reconstructed from other fragments that exist on disk from edits, pagefiles, sys recovery etc. This is entirely separate from the function of CC, which is to overwrite what you tell it to. Can you post a link to fileforum, for interest?

  14. How would a piece of software know that? Recuva can only make a guess at the state of the file based on what I imagine are some fairly basic assumptions, whether the data has been overwritten, etc. Recuva will recover whatever data is in the clusters pointed to by the file entry in the MFT, it can't possibly analyse the data itself, well, not a lot. I wouldn't put too much trust the in the state of the file field.

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.