CC cleaner does not work!

I just registered in order to share my experiences of this problem.

I suggest you start suitable topic(s) in "CCleaner Bug Reporting"

http://forum.piriform.com/index.php?showforum=8

Please restrict each topic to a single issue, e.g.

"Failure to Wipe entire partition", or

"Failure to Wipe Free Space"

If you are concerned about both aspects, then use two separate topics.

This particular topic is blighted by the inconsistency between the first complaint

"took 10 hours to clean the drive free space....and five seconds for recova to find all the files ..."

and the complaint

"I then wiped the drive using 3 passes with cc cleaner.

I then used recuva...not in deep scan mode...and it simply recovered them all no problem.

"

Please also consider and answer in your new topic(s) my questions that appear earlier in this topic.

Finally, what security software do you have running ?

Is it possible that deleted/wiped files could reappear in a "Protected Recycle Bin" ?

Norton springs to mind here.

Regards

Alan

@dogfight

You skewed my advice. If you care to read again I suggest using something like DBAN to erase all the data and THEN reinstall the OS. This does remove data because all you have left are a bunch of random 1 and 0s. Do you know what DBAN is or how it works? Enquire further before you disregard others' advice.

Secondly, each method included in CCleaner aside from the number of passes destroys data using different algorithms (e.g. the "Simple Overwrite" I think just puts 0s in the free space while the Gutmann method uses a set of complex algorithms to put 1s and 0s around.) The 7 passes is the NSA standard. However, that does not mean that they necessarily use it to destroy extremely sensitive data. The 7 passes is probably the minimum that they use to destroy data (probably very common data). Also, have you tried using the Gutmann method?

Besides you said that while you deleted a lot of personal files you were only able to recover minor files. I heard that you can discover a lot about a person with .ttf font files. If you can't recover anything that is personally identifying then the erasure has been successful.

One last note, "securely" does not mean "completely". No method can make data recovery impossible unless you degauss the hard drive and smash it with a hammer (i.e. actually damage the storage medium).

The problem with this topic is, as has already been pointed out, that there is a very woolly definition of the tests or processes that have been run. Much of the time the responders have had to guess what was done.

It's not good enough to say that "You are wrong if you assume that CC is a 'clean to industry data sanitisation' standards. CC has never claimed to do that, it is primarily a temp file remover."

CCleaner IS claiming to "Securely erase the contents ... on a drive". It says so on the Drive Wiper page! It does NOT say that it will "just remove temp files", or even "securely remove most of the files, probably".

I don't want to keep picking on the same person/post, but the statement: "I don't think that any application running under Windows will do what you want, there's just too much going off in the pagefile, logfiles, heaven knows what files for that to be true." - surely cannot be true. As I understand the accepted methods of cleaning a HDD, each bit on the physical disk is actually overwritten - in the NSA case, 7 times. There are no pagefiles or logfiles (or any other files) that can somehow escape and survive this procedure. It is physically impossible. (Ask the NSA!!!)

Well, my definition of an industry data sanitisation standard would be (and I hope that any reputable organisation that performs data sanitisation would agree) that the process is documented, verified and certified. Piriform has never done that.

CC does securely delete data, a single overwrite (NSA is a red herring) of a sector or cluster will make the data on that sector/cluster unrecoverable forever. The problem here seems to be that not every sector is overwritten.

No Windows application can ever clean etc is true, on the system disk for the reasons given. As for CC wiping non-system disks (the only option for an entire drive wipe) I'm not so sure. The process is entirely different from DBAN, (which has been mentioned here) as that is, as far as I know, run from a cd completely independent from any o/s on the disk. CC, on the other hand, reformats a partition, and then runs the wipe free space option. This will of course leave a fair amount of live meta files and boot code in the partition.

DBAN, by the way, does not guarantee its results and does not offer any certification.

'It does NOT say that it will "just remove temp files", or even "securely remove most of the files, probably".'. True, but then nobody ever used these phrases in this thread either.

Does NSA use CC? I really don't know. But I'd put quite a lot of money on them not using it for data sanitisation.

CC does securely delete data, a single overwrite (NSA is a red herring) of a sector or cluster will make the data on that sector/cluster unrecoverable forever. The problem here seems to be that not every sector is overwritten.

I believe I can throw some light on this thread (if anyone is still interested), rather than heat!

From what I can see, "Drive Wiper" is at root a free space wiper. i.e. it overwrites all the bytes in sectors which the file system has marked as not in use. Except with the use of advanced forensic kit, this should render the data in these sectors unreadable on a PC to any software including Recuva, even with just a single pass. If you select the "Entire Drive" option it simply does a fast format making all of the disk (except the root directory) free space, then it does the free space wipe function as described above.

This means that it will not necessarily overwrite directory entries in any directory (Free Space Only mode) or just in the root directory (Entire Drive mode). This is because a directory sector will contain many directory entries and is not freed while any are still in use - the directory records are just marked to show the file has been deleted. Even after a format operation, at least one sector of the root directory will remain. So Recuva may well find directory entries even after a wipe, but it would only be able to recover the file length and size, the content of the file will have been fully deleted.

So the good news is that "Entire Drive" wipe will permanently delete everything except maybe some file directory records from the root directory. If you are concerned about even root directory filenames and dates being recovered, you will need to use a whole disk eraser that erases the entire disk sector by sector at a lower level.