CCleaner removed my desktop and documents

CCleaner for Windows
1

I often run CCleaner but just 10 minutes ago I 'cleaned' on the default settings and my whole desktop plus 'my documents' are removed... it stated 50G of personal data deleted from the 'remover'.

While I might have 3 month old backup lying around, I have yet to understand how much I just lost. I wonder multiple things - why did this occur (yesterday I changed my current account to be owner of the C: drive instead of UpdatusUser)? and second how can I track the record of the deleted files by CCleaner?

CCleaner 3.11.1550 on Win 7 SP1 64 bit

2

I do not know what you mean when you "changed my current account to be owner of the C: drive instead of UpdatusUser"

but it sounds like the sort of thing that can have big repercussions.

Perhaps when you changed your current account then 50 GB within your old user profile went into the recycle bin,

CCleaner has a check box that purges the recycle bin.

CCleaner does not keep a log of what it deletes.

Had you Analyzed before Cleaning you would have known 50 GB would be deleted and either aborted the clean or selected the details and Saved to file.

Recuva may be able to undelete your files unless you use Secure Deletion.

3

It was reseting ownership back to my account (i.e. http://www.addictivetips.com/windows-tips/windows-7-access-denied-permission-ownership/ )

CCleaner did indeed register it as 50gb from the Recycle Bin, but I am quite sure it wasn't actually 'in' the recycle Bin.

4

So you were not changing the user profile or its name then ?

You give a link that shows ownership being claimed on folder \AT of Drive F:\

Were you claiming ownership of the entire drive C:\ with all that it holds, including more than 40 reparse points the last time I counted ?

Did you use LockHunter to break open a lock on C:\ as suggested in an update to the article ?

Did you use icalcs which is mentioned in the subsequent discussion ?

I am good at asking questions :)

Your answers should clarify your situation so others can help.

Alan

5

I claimed ownership on the entire drive and all that it holds (only some .sys files couldnt be changed).

Apparantly data is also lost from the ProgramData folder, additionally to the my documents and desktop folders in the user profile...

It looks like this problem occured http://forum.piriform.com/index.php?showtopic=33767 . I don't quite understand what I did wrong though..

6

default ccleaner can only clean the items in either in it's rules (reading the inbuilt rules is achievable via export command switch however export is broken in the may release) or via the includes option. there is no way ccleaner can clean anything else (without aid of win*.ini files), such a thing literally has 0 possibility of occurring.

if indeed you had something else that remapped your folders you need to seek professional malware help. IMHO it is not ccleaner fault that you tried to take a cleanup into your own hand via this permission change bafflement. no matter how devastating your loss was, & I do feel your pain there, this was not a bug nor flaw in ccleaner

7

I believe Microsoft borrowed the idea of reparse points from Unix, but did not understand what they were doing.

People lost entire libraries of information because Microsoft said that the reparse point could be deleted and the contents it designated would remain.

Microsoft changed their documentation and suggested that users should do tricky things with Access Control Lists (ACL's) to prevent such disasters.

Windows 7 has more than 40 (last year I counted about 50) reparse points or symlinks.

There is no consistency in the ACL restrictions for these things,

e.g. some allow read through only,

some also allow read and write through

I think a few are write through only.

At least some, I think, are protected against delete through.

calcs and icalcs are powerful and tricky beasts that can manipulate ACL's, and I only use them as a desperate last resort.

I do not know what would happen if I "Took Ownership" of my entire C:\ and all it contained,

but I would expect that ACL Restrictions to and through reparse points might be relaxed,

and allow the destruction of all personal data that previously was protected by ACL's