Jump to content

Return to Piriform.com

Photo

How Exactly Does CCleaner Work?


  • Please log in to reply
8 replies to this topic

#1 OFFLINE Yorkshireman

Yorkshireman

    Advanced Member

  • Members
  • PipPipPip
  • 82 posts
  • Gender:Male
  • Location:Derbyshire
  • Interests:I enjoy managing websites, going out to Meadowhall, to the cinema and Hollywood Bowl with friends ...in addition to:<br /> Meeting new people<br /> Chatting/Playing games on Windows Live Messenger<br /> Playing on the computer<br /> Swimming<br /> Biking<br /> Some simple HTML/CSS web-design

Posted 18 January 2009 - 11:48 AM

OK, so I run CCleaner each time I want to clear my browsers memory (including Firefox 3.0.5 and occasionally Internet Explorer 7) because I was under the assumption that the data would be secure deleted (with selecting Gutmann (35 Passes) in the options). However, I not long ago ran Recuva and it was able to recover files that should have been deleted by CCleaner yesterday. :huh:

What's going on?
Yorkshireman
- [My Twitter Profile: Clicky]

QUOTE
Few people are capable of expressing with equanimity opinions which differ from the prejudices of their social environment. Most people are even incapable of forming such opinions.
Albert Einstein

#2 OFFLINE YoKenny

YoKenny

    Super Power User

  • Members
  • PipPipPipPipPip
  • 2,874 posts
  • Gender:Male
  • Location:Oshawa, Ont. Canada
  • Interests:Helping people get rid of malware on their systems then showing them how not to get re-infected again

Posted 18 January 2009 - 01:53 PM

For some reason whenever I see someone from Yorkshire I want to sing:
http://www.dougie.uk...ilkleymoor.html

I guess you must be afraid that Scotland Yard and the latest snooping by British Government might uncover your off-shore monies or business?
"Education is what remains after one has forgotten everything he learned in school." - Albert Einstein
IE7Pro user

#3 OFFLINE Augeas

Augeas

    Moderator

  • Moderators
  • 2,963 posts
  • Gender:Not Telling
  • Location:Where Stuff is made, UK

Posted 18 January 2009 - 02:04 PM

YSM, how did you delete the files, staright CC zap or to the recycler first?

How did you find the deleted files, with Recuva normal scan or deep scan?

Yes, 35 pass is just adding to our carbon count.

#4 ONLINE hazelnut

hazelnut

    try to stay calm

  • Moderators
  • 12,635 posts
  • Gender:Female
  • Location:Huddersfield uk

Posted 18 January 2009 - 02:06 PM

Kenny the gentleman is not from Yorkshire.

Please do not assume a poster is doing something which he does not want the authorities to see.

Some people just like their privacy.
CCLEANER, RECUVA, DEFRAGGLER AND SPECCY DOCUMENTATION CAN BE FOUND HERE

http://www.piriform.com/docs

#5 OFFLINE Yorkshireman

Yorkshireman

    Advanced Member

  • Members
  • PipPipPip
  • 82 posts
  • Gender:Male
  • Location:Derbyshire
  • Interests:I enjoy managing websites, going out to Meadowhall, to the cinema and Hollywood Bowl with friends ...in addition to:<br /> Meeting new people<br /> Chatting/Playing games on Windows Live Messenger<br /> Playing on the computer<br /> Swimming<br /> Biking<br /> Some simple HTML/CSS web-design

Posted 18 January 2009 - 03:02 PM

YSM, how did you delete the files, staright CC zap or to the recycler first?

Using CCleaner. I don't use the recycle bin.

How did you find the deleted files, with Recuva normal scan or deep scan?

Deep scan. I can actually retrieve the files, it's not just displaying the files I can actually view and recover them. :huh:

Yes, 35 pass is just adding to our carbon count.

:lol:

Kenny the gentleman is not from Yorkshire.

Pardon? If I have interrupted that correctly (that I am not from Yorkshire) then you're wrong. I am, I'm from Yorkshire, but I have moved to Derbyshire recently--so that's from Yorkshire but living in Derbyshire. However, if I have interpreted that incorrectly I do apologise.

Please do not assume a poster is doing something which he does not want the authorities to see.

Some people just like their privacy.

Indeed.
Spoiler



Anyway, so can anyone explain why them files that should have been securely deleted have managed to appear again?
Yorkshireman
- [My Twitter Profile: Clicky]

QUOTE
Few people are capable of expressing with equanimity opinions which differ from the prejudices of their social environment. Most people are even incapable of forming such opinions.
Albert Einstein

#6 OFFLINE Augeas

Augeas

    Moderator

  • Moderators
  • 2,963 posts
  • Gender:Not Telling
  • Location:Where Stuff is made, UK

Posted 18 January 2009 - 04:53 PM

Assuming (ah, what misery has been caused in your name) that you found and recovered the files under their correct filename, and not just picked a ZZZZZ.ZZZ file by mere chance, are you sure that the files are not copies made by edit or some other process, and the originals have indeed been securely deleted?

#7 OFFLINE Yorkshireman

Yorkshireman

    Advanced Member

  • Members
  • PipPipPip
  • 82 posts
  • Gender:Male
  • Location:Derbyshire
  • Interests:I enjoy managing websites, going out to Meadowhall, to the cinema and Hollywood Bowl with friends ...in addition to:<br /> Meeting new people<br /> Chatting/Playing games on Windows Live Messenger<br /> Playing on the computer<br /> Swimming<br /> Biking<br /> Some simple HTML/CSS web-design

Posted 18 January 2009 - 05:32 PM

Well they are, for example, images that you would find in temporary Internet files left by IE ...which are meant to be securely deleted by CCleaner. Some have logical names and they are of a .gif or .jpg format.
Yorkshireman
- [My Twitter Profile: Clicky]

QUOTE
Few people are capable of expressing with equanimity opinions which differ from the prejudices of their social environment. Most people are even incapable of forming such opinions.
Albert Einstein

#8 OFFLINE cwalt

cwalt

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 31 January 2009 - 05:31 PM

Yorkshireman, I hope someone can answer the question you have posed. I have the same question.




Well they are, for example, images that you would find in temporary Internet files left by IE ...which are meant to be securely deleted by CCleaner. Some have logical names and they are of a .gif or .jpg format.



#9 OFFLINE Augeas

Augeas

    Moderator

  • Moderators
  • 2,963 posts
  • Gender:Not Telling
  • Location:Where Stuff is made, UK

Posted 31 January 2009 - 07:14 PM

I think that there are a number of things to consider, and some of these I am not sure exactly what the process is.

Firstly CC will only delete the data that the filename entry in the MFT points to at the time of deletion. I'm not sure of CC's secure deletion process, but possibly the data is overwritten, the file renamed to ZZZ.ZZZ, and the file then deleted. The point is that any other data for the filename that exists, for whatever reason, is not overwritten.

Secondly, when the file is overwritten by CC, does Windows create an 'undeleted' temp copy until the process is completed satisfactorily, and then delete it? Even if it didn't, the new (overwritten) data for the file is encoded by the disk software before being written to the disk, just as the original non-overwritten data was. This encoding expands the data by upwards of 5%. If the new data is larger than the old and won't fit into the old data sectors then it has to go somewhere else, leaving an old copy behind. Does Windows do a complete rewrite, to avoid fragmentation, or does it overwrite what it can of the old data and just stick a few new sectors elsewhere?

Thirdly, other common reasons for data to be duplicated somewhere on disk, and not have an entry in the MFT are edits, auto-saves, defrags, etc. Please add any more.

Browsing doesn't involve editing, but those jpgs have to be held somewhere. They could be in and out of ram, pagefile, hiberfile etc. This paging goes on, so I read, almost constantly, and I also read that the pagefile will be used to its capacity by Windows trying to be helpful no matter how much, or little, ram is used. Just watch those page faults mount when you're doing nothing.

It seems that this 'undeleted' data is found using deep scan. I've only run deep scan twice, and what it finds is surprising. Stuff I never knew I had and certainly never deleted. How it gets there is, it seems, rather a mystery.