Jump to content
CCleaner Community Forums

MFT entry for deleted file


Recommended Posts

Non of the standard Microsoft repair tools are able to handle this dll. It's name is qmgr.dll and is in System32 folder despite I have 64 bit laptop. The file, as it appears in explorer shows as if it has a size, but when looking at properties security, it says something to the effect that this is not accessible. When trying to do DEL to delete the file in SAFE mode or in command prompt (using of course elevated option), am told that file does not exist. Tried using full path as well no path from System32 directory. There are no services or processes that are locking the dll because am sure MS repair would have notified if there were.

 

Link to post
Share on other sites
  • Moderators

Yes, but why do you think that this file is corrupt? I think you need someone who is more au fait with repairing Win system files than I am.

Link to post
Share on other sites

A number of other people have described similar senario on this group. I already responded to a post from September. If recuva assumes an intact MFT, then obviously it cannot handle this scenario. Is there anyone on this forum who can give more light concerning the inner workings of this tool?

Link to post
Share on other sites

BTW Although my issue came about hopefully before I examined the CCleaner free edition, I see that that tool allows one to force this scenario because it gives option of deleting the file physically without deleting the MFT entry. One needs to buy the full edition to be able to delete also the MFT entry. So how can I handle this using freeware?

Link to post
Share on other sites
  • Moderators

Now you're saying something completely different. First you said that a system file was corrupted. What makes you think this? What other people have described this 'scenario'? Now you say that the MFT isn't 'intact'. Of course Recuva assumes an intact MFT, as does Windows and the user, it's the most critical file you will ever find, and the most securely protected. Nobody on this forum knows how Recuva's inner workings actually work, we can only second guess from our own experience.

Your understanding of CCleaner is incorrect. CC requests NTFS to delete a file, which it does by flagging the entry in the MFT as deleted. The entry is still there. The 'full edition' acts in exactly the same way. It's NTFS that deletes files, not Recuva. Entries in the MFT are never physically deleted, but flagged as deleted and subseqently reused.

I still don't really know what you're trying to achieve.

Link to post
Share on other sites

Take an example two dll files. The first being qmgr.dll which is blocking any sort of Windows update and the second the file that happens to be before this. qedwipes

qedwipes is fine

qmgr.dll - is listed on file system through explorer or dir command from Command Prompy; properties-general gives name and properties of file as expected; properties-security had red backgrounded X icon with note "The requested security information is either unavailable or can't be displayed"

In elevated command prompt, performing any file manipulation command including takeown, the error "The system cannot find the file specified" is given for qmgr.dll but is fine for the other file. This is what is blocking any sort of Windows update and DISM also when in operating windows in secure mode, cannot handle, as shown on log files.

Obviously when I say "deleted" with respect to MFT entry, I mean "marked as deleted", and the file is obviously not marked as deleted here, otherwise would not see on DIR command. But the indication is that the file is not physically there. 

Are you saying that neither Recuva nor CClean free editions can handle this? 

Do we have a solution to correct this, that does not need a third party application?

Link to post
Share on other sites

Thank you for your input. I have been using Win 10 many years, am talking about version upgrades. I looked into this at first thinking that it was something to do with this service, because this ddl is used for such a service. I have no idea whether I used BITS previously, but since one of the major dll files is inaccessible, and it is impossible to even update it with the latest (I also now have 64 bit version of this in SysWOW64 directory and the file is intact), I am certainly not not running the 32 bit version of the service.

Link to post
Share on other sites
  • Moderators

If it were my machine and I was having 'difficulties' with Win Updates and core windows files I would just do a clean install of Windows 10,.

Not a repair, or restore, just a clean install run from an iso (either on USB or DVD) of the latest Win 10 1909 build.

Create Windows 10 installation media from here

https://www.microsoft.com/en-gb/software-download/windows10

If you just want a local account don't have the internet connected when you do the actual install, if you use a Microsoft Account have the internet connected.

Link to post
Share on other sites

Thanks for the suggestion, but this is what I want to try and avoid. I have, of course a backup of all my files but it is the hassle of having to reinstall all the software I have. 

BTW, I tried today using PrivaZer and it went through all the motions as if it was doing something useful, including removing the file name from its own browsable file list. But looking at the filesystem, I see that it is still "there". Is CCLean purchased edition able to do better?

On 04/12/2019 at 15:01, Augeas said:

Now you're saying something completely different. First you said that a system file was corrupted. What makes you think this? What other people have described this 'scenario'? Now you say that the MFT isn't 'intact'. Of course Recuva assumes an intact MFT, as does Windows and the user, it's the most critical file you will ever find, and the most securely protected. Nobody on this forum knows how Recuva's inner workings actually work, we can only second guess from our own experience.

Your understanding of CCleaner is incorrect. CC requests NTFS to delete a file, which it does by flagging the entry in the MFT as deleted. The entry is still there. The 'full edition' acts in exactly the same way. It's NTFS that deletes files, not Recuva. Entries in the MFT are never physically deleted, but flagged as deleted and subseqently reused.

I still don't really know what you're trying to achieve.

 

Link to post
Share on other sites
5 hours ago, hazelnut said:

If it were my machine and I was having 'difficulties' with Win Updates and core windows files I would just do a clean install of Windows 10,.

Not a repair, or restore, just a clean install run from an iso (either on USB or DVD) of the latest Win 10 1909 build.

Create Windows 10 installation media from here

https://www.microsoft.com/en-gb/software-download/windows10

If you just want a local account don't have the internet connected when you do the actual install, if you use a Microsoft Account have the internet connected.

I appologise, in my last reply, I meant to quote Hazelnut.

Link to post
Share on other sites
  • Moderators

If what you want to do is to restore a damaged file then neither CCleaner nor Recuva is suitable. CC removes temporary files and Recuva copies deleted files, neither will bring a damaged live file back to undamaged condition.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...