CCleaner deletion question

[rcarrwork]

I'm an attorney defending a client. Plaintiff was ordered to preserve her files in her laptop. The same day, 41,000 files are deleted from the laptop. Plaintiff claims her calendared cleanup (CCleaner software) removed those files - even though only a few hundred were deleted in the calendared cleanup on a daily average in the weeks prior.

More telling is that she claims her Word and email files were deleted in the calendared cleanup. We claim she did a wipe, but she denies it, says she deleted nothing on purpose. Court agreed it's "possible" those 41,000 files were just deleted in the calendared cleanup.

Question: Is it possible for calendared cleanup to delete .doc and email files? Even using the most professional version?

[Nergal]

 it is unlikely that ccleaner did this without drive wiper being used (even then it only wipes free space on the primary windows drive).  However data recovery services are oft used in your line of work and (depending on when the judge ordered it) ccleaner's schedule should have been disabled by the respondent.

Enough of my armchair lawyering, we are but users here on this forum (though the developers do intercede when they can or are needed) and can't really give legal advice.

[rcarrwork]

Agree with your analysis, though I'm of course not trying to get a legal perspective...I'm trying to verify that CCleaner cannot be set by an average user to, on a calendar basis, erase files such as .doc and .pdf, etc. I imagine someone knowledgeable could do it, somehow, setting the software to clean out a certain folder - but not an average user.

Edited March 9, 2021 by rcarrwork
had to add a preposition

[nukecad]

CCleaner will not delete any .doc or .pfd files unless the user specifically tells it to do so by setting an 'Include' for them.

An Include can be for specific files or for certain filetypes, in certain directories.
Wildcards can be used in includes to remove certain filetypes or all files in certain directories.

It is an advanced option, and does take a bit of knowledge to set up correctly.

So whilst the court is correct that it is 'possible' that CCleaner could delete such files on a scheduled clean that deletion could only happen at the instruction of the user by both setting up Includes for the files and setting up a Scheduled clean.
The user would have to have previously set the 'Includes' to delete those particular filetypes, from those particular directories, which would then be run on the schedule.

That's not something that could reasonably happen by accident.

See these articles about including files to be cleaned, and setting up cleaning Schedules.
https://support.piriform.com/hc/en-us/articles/360048231491-Select-files-and-folders-to-clean-with-CCleaner-for-Windows#using-the-include-window--0-5

https://support.piriform.com/hc/en-us/articles/360045616091-Scheduled-Cleaning-in-CCleaner-Professional#scheduled-cleaning-in-ccleaner-professional-0-0

Again as Nergal says we are (knowledgable) users here not lawyers, but the above is how Includes and Scheduled cleaning work in CCleaner.

[rcarrwork]

Nukcad - thank you, this is exactly what I thought - but it is hard to explain to older lawyers and judges. It does appear the "computer forensics expert", an ex-cop, was more knowledgeable about how to find hidden files than in how the "cleaner" programs work.

[nukecad]

I've changed the wording of that post a bit. (Just in case you are going to stick it in front of a judge).

[rcarrwork]

Yeah, this is helpful...the lack of understanding by the court and attorneys involved is the problem. An expert testified CCleaner was run by initiation rather than by calendar, and about 34,000 files were deleted, but they never got into the "types" of files. As temporary files were deleted every day, the court saw no difference in the calendar cleaning in days prior and the "initiated" cleaning...even when it was then followed by someone running a defrag - which to us is an obvious step in coverup, but to them didn't mean anything.

 

[hazelnut]

Can I just state here that all OPINIONS given here by members and moderators, are just that ...OPINIONS.

None of the opinions given here should be used as evidence in a court of law.

We are just users here at the end of the day.

You need to deal with things on a much more technical level than we are able to give here on our forum.

[Andavari]

It's sort of damning isn't it!

The only other way I can think of how such files could be deleted without using an "Include" is if the files were stored in a Temp folder that CCleaner will normally empty by default such as the user profile Temp folder, and "C:\Windows\Temp" where left-over generally unwanted files reside from installers, uninstallers, temp files, etc.

And do note over the years some people have incorrectly stored files in a Temp folder and have come onto the forum wondering how they were deleted and how to get their files back.

[Andavari]

1 hour ago, rcarrwork said:

As temporary files were deleted every day, the court saw no difference in the calendar cleaning in days prior and the "initiated" cleaning...even when it was then followed by someone running a defrag - which to us is an obvious step in coverup, but to them didn't mean anything.

 

Not necessarily! Windows is configured to automatically defragment by default and so do some other defrag tools if it's scheduled, i.e.; set it and forget it, and some 3rd party defrag tools can be very aggressive with a high frequency of auto-defragmenting.

[rcarrwork]

None of the post replies here are going to be used in court or in court filings in any fashion.

I'm just trying to make sure I am correct about CCleaner. I do suspect there are ways to get the program to delete files that it normally wouldn't, such as putting in Temp folder - but I'm pretty sure that's going to be only done by someone who knows what they're doing.

[rcarrwork]

Adnavari, I know the defragger can be auto set up...but this was done immediately after about 40,000 files, including some that were rather large, were deleted by someone who "opened" the program - not automatic.

Edited March 9, 2021 by rcarrwork
fixed spelling error