Jump to content
CCleaner Community Forums

Augeas

Moderators
  • Content Count

    4,376
  • Joined

Posts posted by Augeas

  1. Jeez, I'd forgotten this. I'm sure I've changed my mind many times since January, and maybe even learned something.

     

    After re-reading the first two posts I think I agree with what you say. Whether your wishes will be granted is another matter.

  2. I'm not really following this. If you want to make sure files are deleted, why are you recovering them? Just secure overwrite with Recuva.

     

    The path c:\?\ means that the directory record has been reused, and Recuva cannot determine the owning directory. Just overwrite the file with Recuva.

     

    Recuva will not overwrite the file name, nor can it overwrite very small files (under 800 bytes or so). But recovering deleted files is not the way to delete them. Wipe Free Space in CC is the way to go to overwrite file names and small files.

  3. I don't see how Recuva, or any freely available software, could 'see' whether the string of bits in the preview section represented a valid picture or not. It would have to be very clever. As long as the header code or offset or whatever is correct then it's just strings of bytes.

     

    Previews are embedded separately from the main picture, and don't necessarily represent the full picture. There are some picture representations - bmp I think - that don't have embedded previews, and there are also some options in jpegs etc that remove or never include previews. Also it is possible (I've just tried it) to have a jpg that had no preview and when recovered had a complete picture. Whether that jpg had a corrupted preview or none at all I don't know.

     

    So excluding pictures that don't have previews may eliminate valid recoverable pictures from any recovery.

     

    As for 2, I think I'd rather see a few pics now and wait for the next page to refresh (no matter how irritating) than wait for all 50 or 60 or more thousand previews to be loaded before seeing any at all. But I'm impatient.

     

    3 - a right-click option to see the full pic - yes, a good idea.

  4. From what I can see of ForceTrim, CC's Wipe Free Space does the same thing, if you use one pass of zeroes. The way the SSD controller manages pages of zeroes effectively TRIM's all the free space (although I don't have knowledge of all controllers, I would expect them to act in a similar way). I've mentioned before that this is what sent the OCZ forums into a tizzy some years ago, but nobody rose to the bait.

     

    This is a rather cumbersome way of trimming a volume, so perhaps Windows Optimise behaves in a more effective manner to obtain the same result.

  5. There's some further background on the state of the disk at http://www.computerhope.com/forum/index.php/topic,130104.0.html

     

    Are you trying to recover the directory structure? If so you could try unchecking that and see if you can recover a few of the 'not found' files. The error message indicates that there is an error in the path to the file, so recovering without the path might help.

     

    It would help if you gave the Recuva options you are using. Normal or Deep scan? Restore folder structure? Scan for non-deleted files?

  6. Actually I think that this could be useful. I have, in earlier versions of Recuva, run a deep scan and then pressed some key or other and the whole list disappears, to great frustration. The ability to cancel the scan and see the part list of results was a great step forward.

     

    Most of the processes required to implement this are already available. You could have the standard right-click and save to text file, with perhaps a warning message if you're saving to the same drive. Then users could play with the list to their hearts' content. That's an easy half-way stage.

     

    To import a saved list implies some changes, apart from the code to do the import. There are three types of files, Undeleted Files, Deleted (MFT) Files, and Deleted (Deep Scan) Files. The deep scan files would need to have their Logical Cluster Number or L. Block Address and perhaps some other parameters retained in the list, otherwise you wouldn't know where the file was without doing another deep scan. The Undeleted and Deleted (MFT) files wouldn't need this as MFT access is fast.

     

    So now we have the list imported back into Recuva: what do we do with it? Recovery is exactly as it is now. Any data in the list, whether the list is new or imported, can be recovered. Or should I say any LBA pointed to by the list can be recovered, whether the data is relevant or not. It's just data held on sectors.

     

    Secure deletion is more complex, but the process for dealing with an entry on a list that is, or might be, out of date is already in use in Recuva. It has to be or Recuva would be destructive.

     

    The list changes in time, it decays. But there's no difference between a day-old list being imported and Recuva being left open for a day. No pc is entirely static, and a Recuva run may be out of date to some extent the moment the list is produced on the screen. Whilst recovery is unaffected secure overwriting is. Recuva already does a second check before overwriting data, and presumably puts some sort of lock on the data to be overwritten. You can check this yourself by clearing browser history, running Recuva, then browsing the BBC or some other heavily inflicted sites. The Recuva list remains unchanged and files at the top of the list can be recovered. But some can't be overwritten as they are no longer 'deleted', but contain live data.

     

    There'd be more posts saying that 'I've imported a list and I can't recover a file,' so perhaps a warning notice would be helpful when importing a list. And maybe a 'This list is x days old' message.

     

    PS Oh yes, some bright spark would want to import a list from another partition. Perhaps a volume ID check, or just stop at the easy half-way stage.

  7. I have no great opinion on creating a restore point after reg cleanup, I just have the Windows default daily point creation.

     

    CC has the option of deleting any restore point, which means you can have 'before and after' restore points still existing and usable. To run a sys restore from (or to) a point before the deleted point Windows needs the info in the deleted point. CC will delete only the log entry for the point, making it inaccessible, whilst leaving the bulk of the backed up data for Windows to access should it be necessary. Thus you will get very little space freed after using CC to remove restore points.

  8. I thnk that one of the dev's posted that shortly after the wipe free space option came out (on Feb 27 09) but I can't find the reference now. In any event the wipe speed indicates that it's one pass. If anyone tried to Gutmannise wipe free space then they'd still be waiting for it to complete. That's terabytes of writing.

  9. Well, CC isn't, and has never claimed to be, a forensic cleaner. It's a widely used, easy to use, general purpose utility that clears temp and unneeded files from mainly home pc's. It has some data overwrite function that was possibly added in response to user demand. I wouldn't expect it to stand up against specialist data overwriters.

     

    Wipe Free Space uses one pass of zeroes, and (as far as I know, I haven't ever used it) doesn't touch the MFT, so all old file names will remain. I believe CC just uses the 'Fill the disk with large files then delete them' philosophy. It puts off casual probers.

  10. The state of the file as shown by Recuva should not necessarily be taken as gospel, it's the best estimate the Recuva software can make of the prospects for recovery. It looks as if your files have been overwritten in part or whole since they were deleted. In this case recovery will not be possible, or should I say recovery to as deleted condition will not be possible.

     

    Rgds.

×
×
  • Create New...