Jump to content

Augeas

Moderators
  • Posts

    4,542
  • Joined

Posts posted by Augeas

  1. Yes, this is common. With an NTFS disk small files may be held entirely in the Master File Table, not in sectors in the 'user' area of the disk. When deleted the entry will be flagged as deleted but the data remains.

     

    CC will securely delete these files, but they cannot be overwritten after they have been deleted, as Recuva quite wisely does not attempt to alter the MFT.

     

    In time, as new files are created, the entry, and the data in it, will be overwritten.

  2. Alot of these files I can't afford to lose.

    The nip down to Poundland/Dixons/Woolies/anywhere and buy a fiver's worth of CDRs, and copy all of the files you can't afford to lose to them. Then devise a backup process where you have copies of your valuable files on at least two cdrs.

     

    Then follow H's excellent advice. Get help from the major a/v producers' websites to get rid of your virus asap.

     

    I find that the .lnk files are just shortcuts to the 'real' files, and can be deleted with impunity. CC will not delete user files/folders with impunity.

  3. In the Analyse step CC should run quite quickly, with only a slight increase if you have a large number of temp files. If you are running the Clean stage then the first run of CC can take some time.

     

    Have you changed any Options/Settings, specifically from normal to secure deletion? This can make CC Clean stage run forever if you have a large number of files.

  4. What do you mean by 'overwrote it'? Did you use CCleaner secure deletion or some other software? Did you just copy a same-named file on top of it? Did you edit/save it?

     

    Have you already used Recuva normal scan to look for the file?

     

    Don't use the flash drive for anything at all. Run a Recuva deep scan on the drive and then plough through all the files returned to see what's there. You may find a copy of the file before it was overwritten. If so recover it to your hard drive, don't put anything on the flash drive until you've recovered the file or given up.

  5. I think that the size is irrelevant, the address might be relevant, but only - as far as I can tell - if you are using custom folder deletes or some fancy ini file coding. The run-of-the-mill deletes come from run-of-the-mill folders and don't tell anyone anything.

     

    As far as I can deduce CC securely deletes by overwriting the file, renaming it, and then deleting it. CC could safeguard the name of the folder by moving the files into a temp holding folder and then doing the business, but that may result in more 'floating' sectors holding temp copies of the files which could be recovered using deep scan.

     

    You could give innocuous names to your custom folders.

  6. Yes, and Yes, and why?

     

    Changing a secure delete setting will not affect anything previously done, so files deleted using normal or other deletion types will remain as they are. I think that if you investigate a little you will find that one overwrite will be sufficient security for any pc user, unless your name is Putin or Bush, and even then I'm not convinced. The paradox is that one overwrite will render the overwritten data unrecoverable by anyone except very clever aliens, but there's almost certainly other bits of the file remaing on the disk that can be discovered by forensic experts.

     

    If you want to re-clean previously securely deleted files then use Recuva. Select the files and right click and select Secure Delete. The delete option used is specified in the Options box. All securely deleted files (using CC) will be renamed ZZZ something (display them by settings in the Option box), so there may be a lot to do. You'll probably guess that I think it's not worth the effort.

  7. I'm on XP Home, I don't have any .tmp files on my C drive, but a few similarly named zero-byte files in C:\Documents and Settings\myname\Local Settings\Temp (rather surprisingly I don't have Clear Temp Files ticked).

     

    As has been pointed out these files are most probable being created by some application, not the OS. If you enter 'tmp files c drive' (no quotes) in Google there are many others with the same problem which seems to be caused by some application. It may be possible that you can identify what is creating the tmp files on your pc from these postings.

     

    CC cleans known system and popular application temp files from known locations. If it tries to clean files where it doesn't know what created them (as in the case of .tmp files on the c drive) it would be asking for trouble.

     

    Your English is excellent, by the way.

  8. Can't remember, there would be too many to list, and it depends on your particular installation. I guess the answer is whatever you have on your fresh installation. If you want any advice (not always guaranteed to be good) on a specific setting then just ask.

     

    I would go steady on the Registry cleaning, and also uninstalls and startup until you are more familiar and confident with CC. Also don't permanently tick a box that brings up a You will lose all Your Settings message.

  9. If you click on the Options tab in the top r/h corner, select Advanced, you will probably have the Show Zero Length Files and Show Securely Deleted Files boxes unticked. Ticking these will show all the files Recuva has found. Unfortunately this is unlikely to help you find anything worthwhile, but you may as well have a go. It's the sort of thing you do once to see what happens and then set the tickboxes back to blank.

     

    You don't say that you can't find your deleted files, but if you can't you could try the Deep Scan option. This will take forever to run and will return a lot of files, but may be worth the effort.

  10. When you put your files in the recycle bin did you then delete them, either specifically or by emptying the recycle bin?

     

    What exactly did you do, and to what files, when you say that you reinstated the recycle bin?

  11. Eraser's website says....

     

    'If you erase a whole drive, Eraser will not clean the MFT/FAT. To do that you need to format the drive - think this is what BCwipe does. Formatting is the only way to safely remove the ghost entries from the MFT/FAT. So after erasing a drive you need to finally format it. Equally you will be able to recover 'data' from these files but only the erased information and not the original data.'

     

    and this....

     

    'You can choose whether filenames are cleared or not, and Eraser can even clear names of all previously deleted files (when erasing unused disk space).'

     

    I suppose it depends what clean, clear and erase means. I haven't the foggiest, as I don't use eraser.

  12. The avatars you can see will have been downloaded by your browser just by viewing the forum, don't worry about them.

     

    How did you delete the folder and your other pics? Did you use the recycle bin?

  13. Look at whatever drive they files were on, or look at all of them. If you deleted them to the recycler and then emptied it the files will be renamed to something like dc1.jpg etc.

     

    As for pics you have never loaded, yep, it is a puzzle, but they certainly didn't generate themselves.

  14. Recuva will restore whatever is in the clusters which were allocated to the deleted file, so if these clusters have been overwritten then you will be restoring rubbish. Have another look at the deleted file, if it still exists, and see if it has been overwritten. Recuva does not alter any restored data.

  15. You can chose individual files to restore. Recuva is very fast, I would restore to a flash drive to be safe until you have retrieved all that you want or can. If you deleted to the recycler your files may be renamed (ask here). You can order the Recuva results by date, or type etc to help your search.

     

    PS CDRs are somewhere between 10 and 15p a throw. Use a few.

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.