Jump to content
CCleaner Community Forums


  • Content count

  • Joined

  • Last visited

Everything posted by Augeas

  1. I have never known Recuva to take more than a few minutes at the most with a normal scan. I have just run a normal scan on a file/folder and it took under 14 seconds (on a modest but ancient system).
  2. Some recovered file names start with $$_

    I've no idea. Do you mean start with "$$_"filename, or $$_filename? Does the folder name give you a clue?
  3. A defrag is bad news. As you know only too well it will utilise any free space it requires to create unfragmented files, and that free space includes the files that were deleted. So a percentage of the deleted files could well be overwritten. A normal scan may find evidence of the deleted files, as their records will still be in the MFT, but the clusters they previously used will quite possibly be overwritten.
  4. The entire disk is being read, not just the old lost data. Two tb is a large drive, about 500 million 4k clusters, each of which has to be read and analysed, and an internal results table built. Unfortunately 18 hours is not an unrealistic time, going from what others have posted.
  5. Cannot delete pictures

    You could run Defraggler to defrag free space. If you're not a Defraggler user then see how to in the documentation. Then rerun the wipe free space Are you running Drive Wiper?). If you do this then please let me know the results, as it will test a theory of mine. Alternatively run Recuva deep scan then select all/overwrite selected (one pass). This will still leave very small files (under 700 bytes) untouched, as they are held in the MFT. This is a bit of a sledgehammer solution.
  6. No, the filter applies only to the results of the scan, the scan will still take the same time as all sectors have to be scanned. You don't say what the capacity of your drive is, if it is huge then a deep scan will take some time. Eight hours is not particularly long. It might be just me, but perhaps a backup of data before doing a system install would be circumspect.
  7. 1) Is this disk included in Windows' regular defrags? I don't know if usb connected devices are included but it's worth checking. Plus things I can't think of or don't know about. 2) I think that it's safe to say that a device withour power or means of access will be safe from modification, except by Martian death rays. If it is connected then it could be modified. I'm not saying that it will be, but nobody can say for sure that it won't. 3) More or less the same answer as 2. Not as far as I know. Maybe there is some error checking done or logs written somewhere. 4) A normal scan is very fast and reads the MFT, not the disk. A deep scan takes far longer and reads each unallocated cluster. It is advantageous if you can recover your files from a normal scan, they will be complete and up to date, one hopes. A deep scan does not retrieve file names or secondary extents, only selects a small range of file types, and does not differentiate between files days or years old. And takes ages to run. 5) A recovery - as long as you are recovering to a different device - should not harm the files nor degrade any future recovery attempts. It is a read process.
  8. can not identify file type

    Don't use any selection criteria, just search for everything and sort the results later.
  9. Ccleaner Portable

    No, I run Windows Defender.
  10. Ccleaner Portable

    I've run CC portable for years and it has never updated automatically. There is an option in Option?settings to be informed of updates, which is unchecked. There is also the option to accept silent background updates, which is greyed out and unselectable. It also has the CC Pro logo next to it, implying that silent updates are not available in CC free?
  11. MP4 files recovered but won't play

    There are difficulties in recovering very large files, very fragmented files, very old - and very new - files, and files on FAT32 devices. These are to do with the way the file system handles file deletion, not to do with Recuva (or any recovery software). Recuva will recover (i.e. copy) whatever is in the clusters pointed to by the addresses held in the file tables. In Recuva advanced mode have a look at the file header. Does it look valid (you can find out what a valid mp4/wmv file header looks like with Google)?
  12. Recovered files corrupted

    Plese post screenshots of Recuva, not your private documents, no matter how corrupted they are.
  13. First of all, we are talking about an HDD (not SSD), and it’s NTFS (not FAT32)? There’s been no change to Recuva’s recovery techniques well, forever, as far as I can tell. Also I don’t know of any Windows setting that would cause this. So I think it’s some other factor. If the files had been sent to the recycler then NTFS renames them to two components called $Innnn.ext and $Rnnnn.ext. Ignore the $I as they are indexes. Your videos may be recoverable under the $R names. Don’t put any search criteria when running Recuva. It won’t catch the above $R files for a start. Just search for everything, it won’t take any longer. I assume you’re running a normal scan. I wouldn’t run a deep scan yet. Have you run a wipe free space with wipe MFT? This will of course erase pretty much everything. Recuva will scan the MFT and show all file names for all records that are flagged as deleted, including the $I and $R files. These deleted records in the MFT will remain available until another file creation overwrites them. The greater the activity on the drive the more likely the names will be overwritten. Files created and deleted, as in your test, are most likely to have their MFT records reused quite quickly, as they used the first available record when they were created, and on deletion they become the first available record again. I’ll post again if I think of anything else. At the moment I would concentrate on the first two points, the $R names and the search criteria.
  14. what is black box testing

    Yes, he - or she - was warned in his last thread. He doesn't actually seem to spam anything but the questions are very childish.Perhaps he's never heard of Google.
  15. Wipe free space on SSD and HDD

    I don't agree with you Willy as - apart from the wear on the SSD - wiping free space cannot possibly achieve what it is trying to do as you cannot physically overwrite an SSD page. To the O/P, TRIM is an inbuilt function that tells the SSD that deleted pages are no longer required. If your SSD and PC/laptop are no more than say, five years old then TRIM should be available and enabled automatically. With TRIM there should be no deleted files in free space as the pages are emptied by the SSD controller. However TRIM is not infallible and occasionally some pages (deleted files) are left in an SSD's free space. To get rid of these you can run an Optimise from either Window's defragger or Piriform's Defraggler. This in effect runs a TRIM on the whole SSD and removes any deleted files there may be in free space. Mnay of your questions can be answered (far better) by Google or Wikipedia.
  16. Settings > Wipe Free Space drives

    Whenever you check the Wipe Free Space box in Cleaner/Advanced, and next run Cleaner, or if you r/click on Wipe Free Space in Cleaner/Advanced and select Clean Wipe Free Space.
  17. 35 Pass Wipe Took Up All Free Space

    You could download Recuva (portable) if you haven't alrready, in Advanced Mode Options/Actions check Scan for Non-Deleted Files (don't check Deep Scan) and run it. Then l/click on the State column header to sort the results, which will bring the Non deleted files to the top, and look if there are any unrecognised large files there. Or l/click on Size to order by size. If you find anything you can then delete them in Explorer, not Recuva.There are other ways of finding files on a disk, I'm sure.
  18. 35 Pass Wipe Took Up All Free Space

    You should have one or more files with long apparently random names in the root directory with a create date of the wipe. And of approx 400 gb in total. Delete them. Overwriting 35 times is, well, what can I say, rather excessive. That's writing about 18 terabytes of data to your drive when a single pass of 500 gb would have done just as well. The 35 pass overwrite is pointless, decades out of date and a waste of your time which you could spend mining for bitcoins, or some other ridiculous exercise the human race is prone to follow.
  19. Finding .ORF files

    If you have selected pictures as a scan filter then don't, clear any file type filters you have. I don't think that Recuva recognises .orf as a picture format. Is your laptop drive HDD, SSD, NTFS, FAT32?
  20. Analyze Report

    Well, you can right click and select Save to Text File.
  21. Cannot recover the files

    Why not attach a file in a format we can open?
  22. unable to reade recoverd excel data

    We can't open that file. Please post as a screen snapshot, with other information.
  23. As we don't know what the 'different overwriting program' was (and don't tell me, I will know nothing about it) we'll have to assume that the process was similar to CC's, i.e. that the file is edited to contain only zeroes then it is deleted. It's a bit of a misnomer, there is no such thing as secure deletion, it's an edit then delete. The MFT record for a file contains a header then a string of variable length attributes, beginning with $Standard Info, then $File Name. etc. Attribute $Data holds the addresses of each data fragment as a cluster start number and cluster count. If there are many fragments then the addresses can't all fit into the 1024 byte record, so a new MFT record is created containing just the $Data attribute, and the main MFT record points to that. (These cluster addresses are often held as negative little-endian, which is not to be trifled with, but I digress.) When a file with a large number of fragments (and multiple MFT records) is deleted then NTFS overwrites the cluster addresses in the extension records and overwrites the link to the extension records in the main MFT record. I've no idea why NTFS does this, it probably values MFT integrity over assistance in recovering deleted files. So you are left with an MFT record (which Recuva finds) with a file size of 1.2 gb in the $File Name attribute and no accessible data clusters. I have seen Recuva issuing the data not on disk message in similar cases. I haven't tried to overwrite one of these records but I would not be surprised if Recuva says that the data is resident in the record (which as sure as grass is green it isn't), as there are no data clusters to locate and overwrite. I am coming (OK, I'm already there) to the conclusion that your 1.2 gb file was in many fragments and the above scenario applied. It's not much to worry about (but why were you tryimg to recover a securely deleted file?). If the file had been normal deleted then a wipe free space would be required to overwrite it.
  24. The really foolish thing is that Analyse gives the results in the old 'advanced' mode, everything set out just as you want it. Then Run Cleaner switches to baby mode, so there is no immediate comparison to the analysis unless you faff around switching modes. There's no right click in baby mode either. I suppose I'll have to get used to it, but I'm not impressed with a picture of the Invisible Man and a coffee cup with a piece of paper in it.
  25. guillermo eiland California

    Perhaps a dictionary is the best place for the answer. I assume that English is not your first language, I'm pretty sure you're not Guillermo Eiland the actor, and I'm certain you don't come from California. Your posts here and on many other forums tend to be a little spammy, maybe some offline study would be a help.