8 replies to this topic

[Yorkshireman]

OK, so I run CCleaner each time I want to clear my browsers memory (including Firefox 3.0.5 and occasionally Internet Explorer 7) because I was under the assumption that the data would be secure deleted (with selecting Gutmann (35 Passes) in the options). However, I not long ago ran Recuva and it was able to recover files that should have been deleted by CCleaner yesterday.

What's going on?

[YoKenny]

For some reason whenever I see someone from Yorkshire I want to sing:
http://www.dougie.uk...ilkleymoor.html

I guess you must be afraid that Scotland Yard and the latest snooping by British Government might uncover your off-shore monies or business?

[Augeas]

YSM, how did you delete the files, staright CC zap or to the recycler first?

How did you find the deleted files, with Recuva normal scan or deep scan?

Yes, 35 pass is just adding to our carbon count.

[hazelnut]

Kenny the gentleman is not from Yorkshire.

Please do not assume a poster is doing something which he does not want the authorities to see.

Some people just like their privacy.

[Yorkshireman]

Augeas, on Jan 18 2009, 07:04 PM, said:

YSM, how did you delete the files, staright CC zap or to the recycler first?

Using CCleaner. I don't use the recycle bin.

Augeas, on Jan 18 2009, 07:04 PM, said:

How did you find the deleted files, with Recuva normal scan or deep scan?

Deep scan. I can actually retrieve the files, it's not just displaying the files I can actually view and recover them.

Augeas, on Jan 18 2009, 07:04 PM, said:

Yes, 35 pass is just adding to our carbon count.

hazelnut, on Jan 18 2009, 07:06 PM, said:

Kenny the gentleman is not from Yorkshire.

Pardon? If I have interrupted that correctly (that I am not from Yorkshire) then you're wrong. I am, I'm from Yorkshire, but I have moved to Derbyshire recently--so that's from Yorkshire but living in Derbyshire. However, if I have interpreted that incorrectly I do apologise.

hazelnut, on Jan 18 2009, 07:06 PM, said:

Please do not assume a poster is doing something which he does not want the authorities to see.

Some people just like their privacy.

Indeed.

Spoiler

I have OCD so I feel the need to.

Anyway, so can anyone explain why them files that should have been securely deleted have managed to appear again?

[Augeas]

Assuming (ah, what misery has been caused in your name) that you found and recovered the files under their correct filename, and not just picked a ZZZZZ.ZZZ file by mere chance, are you sure that the files are not copies made by edit or some other process, and the originals have indeed been securely deleted?

[Yorkshireman]

Well they are, for example, images that you would find in temporary Internet files left by IE ...which are meant to be securely deleted by CCleaner. Some have logical names and they are of a .gif or .jpg format.

[cwalt]

Yorkshireman, I hope someone can answer the question you have posed. I have the same question.

Yorkshireman, on Jan 18 2009, 05:32 PM, said:

Well they are, for example, images that you would find in temporary Internet files left by IE ...which are meant to be securely deleted by CCleaner. Some have logical names and they are of a .gif or .jpg format.

[Augeas]

I think that there are a number of things to consider, and some of these I am not sure exactly what the process is.

Firstly CC will only delete the data that the filename entry in the MFT points to at the time of deletion. I'm not sure of CC's secure deletion process, but possibly the data is overwritten, the file renamed to ZZZ.ZZZ, and the file then deleted. The point is that any other data for the filename that exists, for whatever reason, is not overwritten.

Secondly, when the file is overwritten by CC, does Windows create an 'undeleted' temp copy until the process is completed satisfactorily, and then delete it? Even if it didn't, the new (overwritten) data for the file is encoded by the disk software before being written to the disk, just as the original non-overwritten data was. This encoding expands the data by upwards of 5%. If the new data is larger than the old and won't fit into the old data sectors then it has to go somewhere else, leaving an old copy behind. Does Windows do a complete rewrite, to avoid fragmentation, or does it overwrite what it can of the old data and just stick a few new sectors elsewhere?

Thirdly, other common reasons for data to be duplicated somewhere on disk, and not have an entry in the MFT are edits, auto-saves, defrags, etc. Please add any more.

Browsing doesn't involve editing, but those jpgs have to be held somewhere. They could be in and out of ram, pagefile, hiberfile etc. This paging goes on, so I read, almost constantly, and I also read that the pagefile will be used to its capacity by Windows trying to be helpful no matter how much, or little, ram is used. Just watch those page faults mount when you're doing nothing.

It seems that this 'undeleted' data is found using deep scan. I've only run deep scan twice, and what it finds is surprising. Stuff I never knew I had and certainly never deleted. How it gets there is, it seems, rather a mystery.