Tragic - CCleaner just wiped my localappdata folder!

[Rob Pitt]

Still trying to figure out what happened but CCleaner seemingly just nuked my %localappdata% folder.

 

I spotted icons disappearing from my desktop, then chrome disappeared so being tech savy I killed the CCleaner process which I spotted was sitting spinning away a good couple of minutes longer than usual.

 

Sure enough the disk activity stopped but too late, much of my %localappdata% folder is now gone ... ironically I'm now running Recuva to try and recover some stuff.

 

My faith is totally shattered, I really don't know what to say ... something has gone very very wrong.

 

Rob

[Rob Pitt]

PS CCleaner 3.10.1525 on Win 7 SP1 32 bit

[Rob Pitt]

It's even worse than I thought, not just localappdata but seemingly half of my %userprofile% directory too -- that's why my desktop icons started to disappear. Sad times indeed,

[Rob Pitt]

f***

More information; Something had created a F''''ing symlink in my %temp% folder out to a folder in my appdata folder.

I think I know what did it but won't name and shame till I'm sure.

 

Anyway I think CCleaner recursively followed that symlink to a directory effectively jumping out of my %temp% directory and started cleaning other areas of my userprofile.

 

Piriform whilst I appreciate you'd never expect a symlink in %temp% folder ... please for the love of god put in a check and make sure you do not ever ever recurse into symlink directories!!!

 

Thank you.

[Rob Pitt]

Final update for the night:

Culprit positively identified as Perforce 2011.1 Beta software, this creates a symlink from %temp%\p4_test_symlink out to %userprofile%

 

Will be onto perforce support first thing in the morning ... sigh.

 

 

Piriform, my request stands : please never recurse into a symlink, just delete it.

[Andavari]

I hope you at least have a recent disk image of your system to restore from! Sounds like a complete mess!

[Tr3bg0D]

Did you try System Restore to recover your files?

[Alan_B]

Piriform, my request stands : please never recurse into a symlink, just delete it.

Your request might break Winapp2.ini which includes

FileKey1=%SystemDrive%\Documents and Settings|*.rmbak|RECURSE

 

Please note that purging the destination can be beneficial.

I use Junctions to relocate Firefox profiles out of C:\ and onto D:\

CCleaner cleans the caches just as well as ever,

All my firefox *.sqlite files get re-written every time Firefox is used,

and that was an extra 100 MB of differential image file to create and archive each day when they were on C:\.

Now they are on D:\ they are not part of what needs protecting against Security Patch SNAFU's

 

I doubt that deleting a symlink is always safe.

 

Years ago I started using Folder Junctions and found complaints on the internet about the dangers.

M.S. had stated that a Reparse Point could be deleted and the destination would survive - THEY WERE WRONG.

I believe M.S. expunged such details from the Internet - I could not see that.

I did find that M.S. warned of the danger and stipulated that the Access Control Lists should prohibit deletion of these Reparse Point.

 

I have counted about 50 reparse points in Windows 7.

M.S. introduced these things to sell Vista to people using software written for XP,

and the purpose was to deceive the software into running as if "Documents and Settings" etc really existed.

 

I have observed that access permissions/restrictions are not the same for all M.S. reparse points.

Obviously your Beta product software was even more careless in the danger it exposed you to.

 

If CCleaner refrained from purging destinations then privacy related data might survive cleaning.

[Rob Pitt]

Darn I can kinda see that some people may have used symlinks to effectively move files etc to alternate/faster drives.

But at the same time I've just lost a few hundred MB of personal files ... I don't know who to blame.

Between Perforce and Piriform a perfect storm was created that's hurt me big time.

 

Maybe the following of symlinks should be an option that's off by default and which you're prompted about the first time you encounter one?

 

PS Microsoft's in-built cleaner (which is a bit basic I know) doesn't seem to follow symlinks. I haven't looked at other software.

[GeoffreyB]

Rob,

 

Sorry if this sounds crass, but the only real blame here is on you for not having a backup. If you lost a few hundred MB of personal files, you can certainly look at Perforce and Piriform as the effect. But, the cause was you. If these files were that important, why did you not take the time to backup?

 

With today's disk cost, internal and external drives, and usb sticks, backups are fast and easy. A few hundred MB of personal files will fit easily on a USB stick.

 

Sorry for your loss. But, it is an important lesson, especially when playing with cleaners and beta software.

 

Geoff