Deleting Files Instead of Emptying Recycle Bin

[ksnicholas]

My operating system is Microsoft Windows 7 Home Premium 64 bit.

 

I have been using CCleaner 2.36.1233 to empty the recycle bin with secure file deletion NSA (7 passes). I have it set up as a scheduled task for 1 am. Yesterday it was still running at 7 am. It reported it was emptying the recycle bin, but it was actually working on deleting the files in my music folder.

 

I have figured out what caused the problem. I deleted a 'junction point' that pointed to my music folder. I was able to duplicate it by deleting another junction point and then running CCleaner. It deleted the junction point, and then deleted the contents of the folder the junction point was pointing to, and then it started on my music folder. So even though the junction points no longer show in the recycle bin, CCleaner will go to the folders they point to and delete the contents instead of deleting what is in the recycle bin. If I empty the recycle bin using Windows, the problem does not occur.

 

I ran chckdsk (there were no errors) and defrag and installed the latest version of CCleaner 3.00.130 (64-bit) and tried it again, but it was still doing the same thing.

 

I don't know how to fix this. I can't do a system restore because the only restore point is after I made the deletion. Does anyone have any ideas?

 

Someone else reported the same problem on 09/24/2009 using CCleaner 2.15.815 with Vista, but the only response he got was don't use external programs to empty the recycle bin.

http://forum.piriform.com/index.php?showtopic=24370

[Augeas]

The more I read about junction points the more I'm glad I don't have any.

 

From Wikipedia NTFS junction point:

 

Use NTFS ACLs to protect files and directories targeted by junction points from inadvertent deletion or other file system operations.

 

Never delete a junction point using Explorer, a del /s command, or other file system utilities that walk recursively into directory trees. These utilities will affect the target directory and all subdirectories. Instead, use the utilities described below to delete junction points.

 

If the junction point is sent to the Recycle Bin, the targeted files will look safe, but will be deleted when the Recycle Bin is emptied.

 

(In Vista/7) Deleting a junction point using Explorer is now safe.

 

Windows Vista supports a new symbolic link capability that replaces junction points.

 

And lots more. As you're on Win7 I guess that the Windows recycler deletion uses some more sophisticated way of treating junction points than CC.

 

When you say 'I don't know how to fix this.' do you mean recovering the lost files or CC's recycler deletion? You could try Recuva to recover the lost files, but after a defrag the chances are minimal that you will find anything useful. As for CC, just untick the Empty Recycler box and use Explorer instead. Who needs secure deletion anyway? As for using junction points, aaaarrrrgggghhh!

[Alan_B]

I fully agree with all that Augeas has said.

 

I believe Junction Points and Symbolic Links are slightly different classes of "Reparse Points".

I believe there are others that may also differ in exactly what they do and how they do it,

but in general they may "look like" a duplicate of folders and files that are present elsewhere.

 

The problem is that if you delete this "duplicate" you also delete the original and any other "duplicates".

This is regardless of whether the deletion is by your use of CC, or by use of any file explorer.

 

On the Internet I have seen complaints by users that they delete a Junction Point because Microsoft Documentation said it was safe to do so, but they lost everything.

I think Microsoft were able to expunge original documentation from their system and also from Google searches.

Microsoft now document how to manipulate ACL's to give protection.

 

My son dragged me "screaming and crying" into W7 via Dual Boot ! ! !

Tried it but it does not work how XP works.

 

I find that a default W7 installation includes over 40 reparse points of various types and subject to various ACL's. I seems to me it was thrown together by over 40 apprentice trainees each with independent ideas upon how to use CACLS.

 

Elsewhere I have published a path to a reparse point which has access restrictions that :-

Permit inspection of the files held therein,

Permit reading of the files held therein,

PROHIBIT the deletion of the files held therein.

They also allow the writing of files held therein - how helpful ! ! !

 

Please remember that SECURE DELETION involves WRITING random data on top of the file to be deleted,

so the reparse Point will permit total destruction of the contents of the file,

and only the final stage of deletion will be blocked.

 

In these forums I have seen one complaint that some-one used CC to delete the spare OLD WINDOWS backup that was created by some sort of Windows Repair. This included Reparse Points that dealt with his Music Folders.

UNFORTUNATELY the Reparse Points were hard-coded to point at his existing Music files, and not his "OLD MUSIC".

UNFORTUNATELY he chose to use SECURE DELETION - GOODBY MUSIC.

 

N.B. You conclude with a link to a similar problem encountered on Vista.

NOTE - That also included SECURE DELETION.

 

I like XP and normal deletion.

XP and Secure Deletion is a whole new world of hurt.

Windows 7 is a whole new world of hurt.

Windows 7 and Secure Deletion is suicidal.

 

I believe this is probably true :-

"(In Vista/7) Deleting a junction point using Explorer is now safe."

Unfortunately the evidence is that SECURE DELETION will still over-write and destroy the contents.

 

Learn from the mistakes of others. You can?t live long enough to make them all yourself. (Eleanor Roosevelt)

 

Alan

[login123]

. . .

and only the final stage of deletion will be blocked.

. . .

Alan

 

Does that mean you can scramble'em, but not delete'em? Not doubting anything but my ability to read...did I read that right?

Great quote:

Learn from the mistakes of others. You can’t live long enough to make them all yourself. (Eleanor Roosevelt)

Not so sure, though...

[ksnicholas]

When you say 'I don't know how to fix this.' do you mean recovering the lost files or CC's recycler deletion?

 

I mean CC's recycler deletion. The junction points seem to be somehow permanently stuck in the recycle bin. They no longer appear in the recycle bin, but every time I run CCleaner with the empty recycle bin checked, it starts deleting the music folders again. How do I get them out? I have Windows Folder Options set to 'Show hidden filed, folders, and drives' and to NOT 'Hide protected operating system files' but I can't see them.

 

I would like to get CCleaner working, because of the secure deleting feature. My other option to permanently remove unwanted files would be to use the Wipe Free Disk space option, but I would not be able to do that daily, because it takes a long time on two 1 TB drives.

 

I restored the music from backup. I use SyncToy set up as a scheduled task to back up my files daily to my second hard drive and another computer.

[Augeas]

I should move, by copy/pasting if the folder isn't too large, the music folder to a completely different location, and rename it. Will that stop CC's recycler purge? I don't know, but it's a start. I would then delete your recycle bin if you can. If you're the only user then it will be the single folder called something like S-1-5-21-1993962763-162531612-1801674531-1004 in the Recycler folder. I don't know if simply right-clicking on this folder and selecting delete will work, as I'm not going to try it. If it does then Windows will generate another on the next bootup. First I would wait to see if anyone with experience in deleting the recycle bin comes along to confirm this.

[kroozer]

First I would wait to see if anyone with experience in deleting the recycle bin comes along to confirm this.

Yes, I recently deleted mine, works fine. Here is an instruction link.

[ksnicholas]

Deleting the recycle bin fixed the problem. Thank you Augeas and kroozer!

[Augeas]

Ah, so wild guesses do work sometimes!

[Alan_B]

Does that mean you can scramble'em, but not delete'em? Not doubting anything but my ability to read...did I read that right?

That is what I believe.

 

Some while ago I explored why some batch scripts work on XP and NOT on Windows 7,

and I found that the much vaunted "compatibility" of Windows 7 with XP via Reparse Points was utter fantasy.

 

Under Windows 7 if "THIS-PATH" corresponds to %USERPROFILE%\Application Data\

then reparse points redirect to %APPDATA%, but with restricted access.

It deliberately blocks deletion of target files, but not their modification, e.g.

PERMIT execution of "ECHO %TIME% >> THIS-PATH\FILE.TXT"

PROHIBIT execution of "DELETE THIS-PATH\FILE.TXT

This is illustrated in the attached GIF (using Windows 7 Ultimate)

 

There seem to be different levels of restriction on different reparse points.

 

I apply my knowledge of the above to the more recent problems I have seen reported with Secure Deletion.

 

I deduce that if Windows 7 allows me to REPLACE the contents of a file, then I can OVER-WRITE a file, which sounds a bit like what Secure Deletion does.

Hence my assumption that Windows 7 may attempt to block a normal delete,

but a Secure Delete blindsides it - Windows just does not see it coming.

 

I dual boot into Windows 7 but it takes so much longer than XP to finish loading,

and when it has loaded it still does not give me control like XP - everything is in the wrong place.

No way do I wish to go back into it and fight UAC and install CCleaner and experiment with Secure Deletion.

 

I have now seen several complaints of unexpected loss of files where secure deletion is done on Windows 7 or Vista, and Reparse Points were probably at the root.

 

I suggest that someone who is happy to use Windows 7 should look at my attached GIF and confirm that they have the same experience.

Then simply create a file at

"%APPDATA%\TestFile.txt"

Then use CCleaner and stipulate to include deletion of

"%USERPROFILE%\Application Data\TestFile.txt"

My expectation is that NORMAL deletion by CCleaner will be prevented by access restrictions,

but SECURE DELETION will at least corrupt the contents, and may also either delete the file or change the name into gibberish. I would be interested to learn the results.

 

Alan

[login123]

Thanks, Alan_B.

 

Looks like you are right.

 

Something else to think about when I (have to) go to W7. I like to be able to see and control what happens on my computer, gonna be tougher w/ W7, looks like.

[Alan_B]

Thanks, Alan_B.

 

Looks like you are right.

 

Something else to think about when I (have to) go to W7. I like to be able to see and control what happens on my computer, gonna be tougher w/ W7, looks like.

Were you able to see exactly what Secure Deletion did to the target ?

 

When My daughter tired of her new P.C. and offered it as a free gift,

I was lured from Win 98 by the prospect of Built in Broadband instead of USB modem dial-up.

 

Leaving behind faithful INIs and accepting the hidden poison pill of XP's registry is NOT what I had in mind ! !

 

I am tempted to consider installing W7 on a FAT32 format partition,

then I AM IN CONTROL and can delete any part of its interfering nonsense that obstructs me ! !

 

Alan

[hazelnut]

Don't think you can install Win 7 on FAT32 Alan.

[login123]

Were you able to see exactly what Secure Deletion did to the target ?

...

Alan

 

Since the OP's issue is fixed, I guess it is OK to continue hijacking this thread. (Guilty look toward Hazelnut )

 

No, not sure what that means.

Edit. Is it that those files could not be found nor deleted nor accessed by way of UserProfiles, but could by way of appdata?

[Alan_B]

Don't think you can install Win 7 on FAT32 Alan.

Thanks for the warning Hazel.

I will just have to be a bit more devious when I take on W7.

 

Alan

[Alan_B]

Since the OP's issue is fixed, I guess it is OK to continue hijacking this thread. (Guilty look toward Hazelnut )

 

No, not sure what that means.

Edit. Is it that those files could not be found nor deleted nor accessed by way of UserProfiles, but could by way of appdata?

Not quite, Appdata is an Environment Variable that equates to part of the user profile.

 

Environment Variables are good. They are safe, they do what they should, THEY DO WHAT IS EXPECTED.

 

Under XP :-

%USERPROFILE% equates to "C:\Documents and Settings\{username}"

%APPDATA% equates to "C:\Documents and Settings\{username}\Application Data"

%USERPROFILE%\"Application Data" is another way to get to %APPDATA% - good for XP only

 

Under Vista and W7

%USERPROFILE% equates to C:\Users\{username}

%APPDATA% equates to C:\Users\{username}\AppData\Roaming

%USERPROFILE%\"Application Data" is not what you think - it uses a JUNCTION to get there.

It is the path to ruin. It is a Black hole, known to SciFi enthusiast's as the one-way entrance to wormhole through space into another universe.

C:\Users\Alan\AppData\Roaming\ == %APPDATA% is where you write to %USERPROFILE%\"Application Data"

C:\Users\Alan\Application Data\ == NUL is where you read or delete %USERPROFILE%\"Application Data"

 

My GIF shows that I created the file ALAN_LOST via the unidirectional %USERPROFILE%\"Application Data"

after which I deleted on the same route - but it could not be found nor deleted.

Then I appended a further time stamp via that route.

The time stamps actually travelled to

C:\Users\Alan\AppData\Roaming\ALAN_LOST

C:\Users\Alan\Application Data\ALAN_LOST is where W7 tried to delete

W7 uses the JUNCTION as "Smoke and Mirror magic" to hide and protect the destination from deletion.

 

Then I used the bidirectional %APPDATA% as the route and TYPEd the file showing it held both time stamps which had been sent on the unidirectional route.

 

My expectation is that under W7 by stipulating in CCleaner INCLUDE the deletion of

"%USERPROFILE%\Application Data\ALAN_LOST"

THEN normal deletion and the one-way nature of the JUNCTION will protect the target,

BUT SECURE DELETION will overwrite and destroy the time-stamp,

and my question is - what is left by SECURE DELETION via the JUNCTION obstacle ?

i.e. Will ALAN_LOST still exist but holding random characters ?

Will ALAN_LOST have been renamed as part of the obscuration provided by SECURE DELETION ?

Will ALAN_LOST have been totally eradicated in spite of the best efforts of the JUNCTION's ACL restrictions that attempt to protect the contents of the destination ?

 

There are more than 40 JUNCTIONs/SYMLINKDs in W7 with varying degrees of ACL restrictions.

 

I recommend for further information on Environment Variables

http://www.askvg.com/list-of-environment-variables-in-windows-xp-vista-and-7/

http://www.axleration.com/default-environment-variable-values-of-windows-xp-7/

http://www.scriptlogic.com/support/CustomScripts/environmentVariableReference.html

This one has been damaged for a few months, but at one time it had separate columns showing XP and W7 side by side :-

http://wapedia.mobi/en/Environment_variable?t=5.#5.

 

I recommend for further information on JUNCTION and SYMLINKD

http://www.svrops.com/svrops/articles/jpoints.htm

 

 

Please forgive the following rant, but I suffered many days and weeks learning how to overcoming registry problems in XP, when an old version of Comodo was removed but a clean install failed because XP had locked up 2000 registry keys with their values. I eventually learnt how to take ownership and delete ONE AT A TIME.

I quickly gave up on Regedit and found a much better tool which took out the whole shooting match.

Since then I created the technique of exporting a key as a *.hiv, and now a great big tree of keys which cannot be deleted will be replaced when I import that *.hiv at a higher level. ZAP POWER ! !

Now I find that Users on the most popular O.S. (i.e. XP) have published scripts to aid the removal for a clean install update of Comodo, and what works on XP is blocked by unidirectional JUNCTIONS in W7.

The Evil Empire strikes again !

 

The "benefit" of JUNCTIONs is publicised as backward compatibility.

You can buy W7 and your old XP applications can still be installed and initial data can be installed at

"C:\Documents and Settings\{username}\Application Data"

and the magic of JUNCTION will put it where W7 wants it at

"C:\Users\{username}\AppData\Roaming"

How wonderful.

Until the customer has to do a clean instal / update and then XP code tries to delete

"C:\Documents and Settings\{username}\Application Data"

Problem - Could not find C:\Users\Alan\Application Data\ALAN_LOST

Microsoft Marketing to the Rescue - Microsoft Office etc. for W7 (at a price). Who saw that coming ! !

 

Alan

[login123]

Not quite,. . .

Alan

Now there's an understatement...

 

Well, phooey. Another MS Hoop to learn to jump thru. Why do they DO that? To protect us from ourselves? From the bad guys? Fool's errand.

 

That is an excellent treatise on junction points, and I thank you for it. Good rant, too.