[Wonders and Mysteries of WinSXS]

Travellers beware - Dragons be here.

 

When Registry Cleaning "Unused File Extensions" was enhanced a year or two ago,

and it suddenly reported problems with something related to "ehome".

I found at that time that this was related to Windows Media Center which was not part of my system,

and had no presence in either System32 of SysWow64 but was plastered all over WinSXS.

 

I have just used Locate32 to search for ehome and found 189 files and 164 directories.

I am surprised that a HDD can hold all of that Windows Media Center stuff and also find space to accommodate some media to be played

 

I have selected

C:\Windows\winsxs\amd64_ehome-bdatunepia_31bf3856ad364e35_6.1.7601.17514_none_4bcd40fd63f3f7b4\

This holds the file

BDATunePIA.dll

243 KB (249,344 bytes) Created & Modified & Accessed ‎21 ‎November ‎2010, ‏‎03:24:42

 

I used Search on Defraggler 2.13.670 and it found 4 instances of this file at

BDATunePIA.dll 1 238080 C:\Windows\winsxs\wow64_ehome-bdatunepia_31bf3856ad364e35_6.1.7601.17514_none_5621eb4f9854b9af\
BDATunePIA.dll 1 249344 C:\Windows\winsxs\amd64_ehome-bdatunepia_31bf3856ad364e35_6.1.7601.17514_none_4bcd40fd63f3f7b4\
BDATunePIA.dll 1 249344 C:\Windows\winsxs\amd64_bdatunepia_31bf3856ad364e35_6.1.7601.17514_none_c81348afa0c88995\
BDATunePIA.dll 1 238080 C:\Windows\winsxs\x86_bdatunepia_31bf3856ad364e35_6.1.7601.17514_none_6bf4ad2be86b185f\

It is worth noting that these CANNOT be hard links to files in System32 or SysWow64 because if they were then Defraggler should have found these files on those paths also.

I also think it would be naughty of Defraggler to try to defrag Hard Links - Bug Report Naughty

 

I am absolutely convinced that some real files consume real amounts of Disk space within WinSXS.

 

I am strongly inclined to believe the experts who claim that all the files that appear to live within System32 and SysWow64 are actually Hard Links to the alternative realities within WinSXS,

 

But I recognise the diabolical deviousness of Microsoft's underhand methology,

and would not be surprised if Microsoft kept us confused by NOT placing hard links as they are required in System32 etc.

but instead MOVED the files from WinSXS into System32 and then placed Hard Links in WinSXS to make it seem as though they still lived in WinSXS

 

I Used Defraggler to search for a file that I knew could be found in System32 and SysWow64, namely CMD.EXE

This is what it found

cmd.exe 1 345088 C:\Windows\System32\
cmd.exe 1 302592 C:\Windows\winsxs\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7601.17514_none_f387767e655cd5ab\ 

This indicates that there is a real presence in both System32 and also WinSXS\WOW64 ( WOW - I never knew that before )

 

Now using Locate32 and searching for CMD.EXE the results are

Name Size Date Modified In Folder Type
cmd 337 KB 21/11/2010 03:23 C:\Windows\System32
cmd 337 KB 21/11/2010 03:23 C:\Windows\winsxs\amd64_microsoftwindowscommandprompt_31bf3856ad364e35_6.1.7601.17514_none_e932cc2c30fc13b0
cmd 296 KB 21/11/2010 03:24 C:\Windows\SysWOW64
cmd 296 KB 21/11/2010 03:24 C:\Windows\winsxs\wow64_microsoft-windowscommandprompt_31bf3856ad364e35_6.1.7601.17514_none_f387767e655cd5ab

Conclusion :- CMD.EXE appears in 4 locations, and two of those locations are real and two are Hard Link smoke-n-mirrows phantoms.

quite surprisingly the larger 64 bit executable lives in System32

but the smaller 32 bit execuatble lives in WinSXS\SysWOW64.

 

I have now tested Attrib.EXE

This really exists in both System32 and SysWOW64

But Locate32 finds the real plus the Hard Links at

Name Size Date Modified In Folder

attrib 18 KB 14/07/2009 01:38 C:\Windows\System32

attrib 18 KB 14/07/2009 01:38 C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22

attrib 16 KB 14/07/2009 01:14 C:\Windows\SysWOW64

attrib 16 KB 14/07/2009 01:14 C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec

The excitement is too much.

My brain hurts.

I am giving up whilst I am ahead.

 

Regards

Alan

[Unable to recover encrypted file?]

yet I don't understand how to reach the path? In AppData->Local there's no Mozilla, I don't really understand this process.

Just because you cannot see it now does not mean it was not there - otherwise where did Firefox keep its profiles ?

 

I suggest you select the contents of the code-box below and use Ctrl+C to copy in your paste buffer,

and then launch Windows Explorer and click on the address bar (at the top) and use Ctrl+V to copy from your paste buffer,

and with luck Windows Explorer will then show the contents of the Firefox profile

C:\Users\me\AppData\Local\Mozilla\Firefox\

 

they're not in the download folder anymore, I didn't make any copies, I used CC too

By default CC will not delete the contents of the download folder - did you add this to the "Includes" ?

Due you use normal deletion or secure/over-write deletion ?

[Unable to recover encrypted file?]

Is it possible that before you encrypted them you downloaded them via Firefox,

Could there be non-encrypted but possibly normal deleted versions in the Firefox download folder ?

[File Search has defective limitation.]

When I select the SEARCH Tab and specify a target file and then tick the boxes

"Filename contains:" and

"Include non-fragmented files"

and click the "Search" button

I should then see a list of files (and paths), and when I select one of those files the entire drive map should be dimmed apart from the cell representing the the location of that cell.

 

The above works perfectly for files that are 613 bytes long (and also longer files)

Files that are 605 bytes or less are NOT detected, NOT listed, and NOT shown on the drive map.

 

Why no possibility of showing the location of files that are less than 613 bytes in length ?

Are they so small that Windows decides to squirrel them away in the MFT where no one can find them ?

 

I do not know why Defraggler searches for files that I assume are too small to be fragmented (below 4096 bytes)

but it is a facility that is partially provided.

 

I would really like it to list all files regardless of size, down to zero bytes, even if the location is hidden inside the MFT.

There are times when I need to know if a particular file exists and also the path to that file,

but almost never am I interested in the location on the drive map.

 

I wish to use (and recommend) Defraggler as the File Finder par excellence because :-

It searches faster than any other,

It reports what is really there (others see the ghostly residues of what the MFT remembers from the past)

It is NOT obstructed by Access Control Levels that prevent viewing with Windows Explorer

(if the file is in System Volume Information it WILL be seen)

 

I am using Portable DF v2.13.670 (64-bit) under Windows 7 Ultimate + SP1.

Same problem with DF v2.11, and possibly all earlier versions.

 

Regards

Alan

[Is Local Settings/Temp cleaned?]

The files in the folder are several months old (according to created and modified date stamps)

Totally irrelevant.

You should be looking at the ACCESSED date stamp.

(and even looking at a file with Windows Explorer counts as an ACCESS).

[March Desktops]

I wasn't 'talking sideways' ...

 

haven't heard that expression before - talking sideways - is that a UK or US colloquism?

When I was at school and the teacher was writing on the blackboard,

the only sounds were the squeak of chalk on the backboard,

and the occasional mutter of one child to the next - closely followed by the clunk of a solid wood blackboard eraser hitting the culprits head.

Talking from the side of the mouth was the only hope for avoiding detection and a fast moving projectile.

[Application List, mystery entry.]

I am pleased to say that my wife has no administrator privileges on my computer

[BBC Paintings]

hmmm, to what end....

They have a budget that must be spent to justify :-

The need for highly paid BBC administrators ;

and the need for an increase in BBC license fees to facilitate the recruitment of more administrators.

 

I fondly remember the good old days when Radio Caroline ruled the Waves - all for free.

[Can I keep an HDD write protected - till I say so ?]

Thanks - but that is a last resort because :-

 

1.

I had been using partition E:\ on this 600 GB WDC HDD for the purposes of Pagefile.Sys, %TEMP%, and my Palemoon Browser Downloads Folder.

Windows threw a Hissy Fit at me when it no longer had a Pagefile.sys after it killed E:\ by changing this HDD from GPT to MBR.

I have now added partition E:\ in what was unallocated space on a 960 GB Samsung HDD for the benefit of Palemoon Downloads,

and Windows has chosen to recreate an 8 GB Pagefile.sys on this new partition on Samsung.

 

N.B. I do not know why Windows now says the WDC HDD is MBR instead of GPT - perhaps a mistake in the registry which it refuses to correct

 

To ensure removal of some stuff that I regret installing I am intending to restore Windows to a previous state

but unfortunately that state knows of the WDC as containing partition E:\.

When I restore that previous state I need to ensure write protection of WDC - if need be by electrically disconnecting WDC,

in which case there may be another Hissy Fit until it accepts that Samsung holds a new partition and I am allowed to assign the letter E:\.

 

If I disconnect the WDC then I have lost a useful resource,

and immediately I reconnect and Boot up I may discover that the Restored State of Windows will remember its old friend,

and finding a change of partitions may make brand new partition letter assignments to all partitions (other than C:\ remaining allocated to the booted O.S.),

and I fear that this Restored State of Windows will plant a new PageFile.sys on-top of the RAW DATA that I may be UNABLE to recover for another 2 or 3 months.

 

2.

About 15 years ago support technicians were happy to replace processors in Zero Insertion Force sockets after an extraction tool malfunctioned in my hands and they had to fix things.

Since then I focussed exclusively upon software design and debug of real-time computers.

This Desktop was built by my son and thus far I am only familiar with where to vacuum the dust.

If I was 20 years younger I would be happy to identify which is the WDC HDD,

and remove and at a later date correctly reconnect its data and power cables.

 

Regards

Alan

[Can I keep an HDD write protected - till I say so ?]

I used Windows Disk Management to put my Secondary HDD "Offline" and this gives me "Read Access Only".

 

Will it remain write protected when :-

I erase my SSD and restore a partition image backup of System C:\ in an earlier state when WIndows used to write to this HDD; or

I boot into Linux.

 

My hope is that when the HDD was put off-line the HDD internal controller was placed into read-only mode,

and when a previous image of Windows, or a Live Linux Boot DVD is booted up,

the HDD internal controller will remain in read-only mode until Windows (or Linux etc.) issues an "Online" command that cancels read-only.

 

My fears are that :-

 

The "offline" status is a flag somewhere in the first track of the HDD (e.g. in the MBR ),

and that Linux or a badly behaved BIOS might disregard it; or

 

The "Offline" status is private knowledge that Windows keeps in the registry,

and that an earlier version of Windows has no such knowledge,

and will start writing over the RAW and "Unallocated space" Data I have yet to recover and full validate.

 

Regards

Alan

[BIOS Update]

Perhaps this topic might address issues you are facing

http://forums.mydigitallife.info/threads/13095-Undocumented-INSYDE-BIOS-recovery-method-Use-andy-s-tool-to-obtain-possible-names

[Winapp2.ini additions]

Does anyone know why IE 10 for windows 7 keeps creating a Adobe folder in the Roaming folder of the users/app data ? I don't have flash installed so am wondering why every time I delete the thing that IE 10 keeps recreating it . I know it's probably off topic but figgered this to be the best place to get an answer or maybe some idea why.

Perhaps Microsoft are trying for extra revenue from Adobe Reader referrals to compensate for disappointing sales of Windows 8 licences

[CCleaner 4 Suggestion]

Why do you think I'm making my suggestion...so I can pick and choose which -- not all -- restore point(s) to delete.

 

I already have two 1.5TB external drives and my laptop runs perfectly fine with its limited internal disk space. I do a lot of photo editing and try to keep as many photos immediately available as possible. It is when I load and edit multiples-of-gigabytes of new photos that I'd like to decide if it is time to move some offline onto said external drives or whether to delete an old restore point that I know I won't need to revert to.

 

Everyone has their own approach to things, mta.

Why do you need CCleaner to tell you what your Free TreeSize can ALREADY tell you ?

 

It can not only show me the Size of System Volume Information but also the individual size of every restore point folder which it holds.

and further more it can OPEN Windows Explorer to show the individual files and folders that are held there-in

[Download Recuva to harddrive or to a flashdrive?]

Just to clarify :-

You deliberately deleted important Photos to the Recycle Bin,

after which you accidentally emptied the bin instead of restoring to original location ?

[Winapp2.ini additions]

It's a known issue trying to just delete it outright, versus flushing it clean the safe way using Microsoft's Tweak UI. Even using RegSeeker to clean it would result into corruption.

I think I tried Tweak UI with zero success.

 

Eventually I succeeded with Regseeker - BUT that trashed all the carefully located positions on my desktop.

[Windows 7 NOW Requires Me TO Disk Check For My Computer's Drives and Partitions?]

If you have two systems installed on different physical drives, then you should be good.

as long as the systems are not in one physical drive, they won't conflict each other.

because each system it has his own environment.

I seriously doubt that.

 

My Laptop used two physical drives - one internal and one USB2 connected External.

All NTFS partitions on both physical drives had System Volume Information folders holding Restore Point data which were kept synchronised by Windows XP.

 

It is generally known that a dual boot system with both XP and Windows 7 should not allow one O.S. to see the System Volume Information of the other,

otherwise there may be large scale destruction of the restore points on one system.

 

Reparse Points can have a destination that reaches across to a different partition on a different physical drive,

and depending upon ACL's the deletion of a Reparse Point on one drive may delete the contents of the destination on the other drive.

 

If Windows 7 runs under C:\ and observes the Windows 8 partition/drive as X:\ , and

If Windows 8 runs under C:\ and observes the Windows 7 partition/drive as X:\

then the many dozens of Reparse Points that Windows uses to link to sundry folders within C:\

may be expected to continue to point to a destination of C:\,

hence when booting from the Windows 8 drive if you write X:\ the Windows 7 Reparse Points are likely to now point at the Windows 8 drive C:\.

 

I may be wrong - but I believe there may be unexpected and even severe consequences of using one O.S. to write to the drive of the other O.S.

[Winapp2.ini additions]

With more than a trace of sarcasm myself

I propose a standard warning for this and many other CCleaner Fixits :-

"It is STUPID to enable this unless you know why you need to BREAK something by doing so".

 

Even cleaning the ICON CACHE resulted in irreversible damage to my Win XP,

which I had to reverse by restoring a partition image backup.

 

I was (and am) prepared for disaster.

Any one who downloads Winapp2.ini and chooses to ignore warnings (blatant or otherwise) should also be prepared for disaster.

 

I would stipulate that in my view the loss of a Wallpaper is not a loss - and certainly should not be considered a disaster.

It is perhaps beneficial as a salutary warning

[Defraggler and System Volume Information]

Because Restore Points are what is inside System Volume Information.

 

You need to apply a Tick to exclude them

[Is Local Settings/Temp cleaned?]

You need JavaRA to purge old (and/or all - your choice) Java installers and vulnerabilities.

 

http://singularlabs.com/software/javara/

[CCleaner 4 Feature Request]

I too think the idea interesting - as per the proverbial Chinese Curse

"May you live in interesting times"

 

There are many people that use CCleaner for safe removal of junk because they cannot make the distinctions themselves.

Giving them a button to click and remove a file that is in use may do damage that they cannot repair.

[Winapp2.ini additions]

Having an entry in winapp2 that breaks peoples wallpapers, on the basis that it sometimes fixes people's wallpapers is strange reasoning for inclusion to me.

I disagree.

People REALLY should not tick every box just because there is a box to be ticked.

 

I suggest that this should be retained for the odd occasion when it might be needed,

with a WARNING that this should ONLY be used to destroy a frozen wallpaper.

[Defraggle Improper SSD handling]

I find that 64 bit DF v 2.11 knew the difference upon launch - AND DISPLAYED "SSD Detected" under the Status column

Sadly that information is destroyed when it is replaced by "Analysis Complete" after clicking the Analyze button.

 

Regretably 64 bit DF v 2.13 does NOT display "SSD Detected" either before or after clicking the Analyze button.

 

Although DF does not display which are SSD,

it correctly removes them from the list of partitions available to Defrag when I use :-

Settings => Options => General, and UN-tick the option "Show SSD Drives".

 

N.B. I tested above with default settings on Portable versions of DF.

 

I suggest the Default Settings show be altered thus

Settings => Options => General :- UN-tick the option "Show SSD Drives".

Settings => Options => Advanced :- TICK the option "Stop VSS when defragmenting NTFS Volume"

[Windows XP Home system temporary files]

At the very best of times I have no confidence in System Restore on XP.

Amongst other things it cannot decide if Firefox caches are System Files to be preserved, of User Files to be abandoned.

 

If you run CCleaner and it removes 976,800 KB,

then if your Free Space remains as it was then System Restore has perfectly preserved all those files which you fear might be essential.

 

If, as I suspect, you actually gain 976,800 KB of extra free space,

Then System Restore has decided that these files are beneath its dignity and it has preserved nothing at all.

 

What you really need (and I suggested years ago) is a CCleaner option to purge the old stuff from the Recycle Bin,

and then everything else that is removed to be deleted INTO the recycle bin.

Then if something is broken you can restore from the recycle bin.

 

But Sadly .....

[Winapp2.ini additions]

Please note that depending upon Access Control Levels, when You delete a Reparse Point you may well delete the files at the destination,

so it would not surprise me if a "successful" deletion of %SYSTEMROOT%\WINSXS\ also destroyed the contents of %SYSTEMROOT%\SYSTEM32\

[registry cleaners]

That seems unlikely.

 

Cleaning the registry too much has almost no effect on the number of files on your computer,

but it is likely to cripple the operation of the computer,

and only in extreme cases would I expect the computer to delete its files as a result of being crippled.

 

You should certainly notice your computer misbehaving long before you would notice the loss of files.