Jump to content
CCleaner Community Forums
DZiants

MFT entry for deleted file

Recommended Posts

I have a damaged file - it seems that there is an index entry in MFT but the file does not actually exist

Can Recuva be used to recover such file?

Share this post


Link to post
Share on other sites

What exactly do you mean? Is the file live or deleted? What makes you think it doesn't exist?

Share this post


Link to post
Share on other sites

Non of the standard Microsoft repair tools are able to handle this dll. It's name is qmgr.dll and is in System32 folder despite I have 64 bit laptop. The file, as it appears in explorer shows as if it has a size, but when looking at properties security, it says something to the effect that this is not accessible. When trying to do DEL to delete the file in SAFE mode or in command prompt (using of course elevated option), am told that file does not exist. Tried using full path as well no path from System32 directory. There are no services or processes that are locking the dll because am sure MS repair would have notified if there were.

 

Share this post


Link to post
Share on other sites

Yes, but why do you think that this file is corrupt? I think you need someone who is more au fait with repairing Win system files than I am.

Share this post


Link to post
Share on other sites

A number of other people have described similar senario on this group. I already responded to a post from September. If recuva assumes an intact MFT, then obviously it cannot handle this scenario. Is there anyone on this forum who can give more light concerning the inner workings of this tool?

Share this post


Link to post
Share on other sites

BTW Although my issue came about hopefully before I examined the CCleaner free edition, I see that that tool allows one to force this scenario because it gives option of deleting the file physically without deleting the MFT entry. One needs to buy the full edition to be able to delete also the MFT entry. So how can I handle this using freeware?

Share this post


Link to post
Share on other sites

Now you're saying something completely different. First you said that a system file was corrupted. What makes you think this? What other people have described this 'scenario'? Now you say that the MFT isn't 'intact'. Of course Recuva assumes an intact MFT, as does Windows and the user, it's the most critical file you will ever find, and the most securely protected. Nobody on this forum knows how Recuva's inner workings actually work, we can only second guess from our own experience.

Your understanding of CCleaner is incorrect. CC requests NTFS to delete a file, which it does by flagging the entry in the MFT as deleted. The entry is still there. The 'full edition' acts in exactly the same way. It's NTFS that deletes files, not Recuva. Entries in the MFT are never physically deleted, but flagged as deleted and subseqently reused.

I still don't really know what you're trying to achieve.

Share this post


Link to post
Share on other sites

Take an example two dll files. The first being qmgr.dll which is blocking any sort of Windows update and the second the file that happens to be before this. qedwipes

qedwipes is fine

qmgr.dll - is listed on file system through explorer or dir command from Command Prompy; properties-general gives name and properties of file as expected; properties-security had red backgrounded X icon with note "The requested security information is either unavailable or can't be displayed"

In elevated command prompt, performing any file manipulation command including takeown, the error "The system cannot find the file specified" is given for qmgr.dll but is fine for the other file. This is what is blocking any sort of Windows update and DISM also when in operating windows in secure mode, cannot handle, as shown on log files.

Obviously when I say "deleted" with respect to MFT entry, I mean "marked as deleted", and the file is obviously not marked as deleted here, otherwise would not see on DIR command. But the indication is that the file is not physically there. 

Are you saying that neither Recuva nor CClean free editions can handle this? 

Do we have a solution to correct this, that does not need a third party application?

Share this post


Link to post
Share on other sites

Thank you for your input. I have been using Win 10 many years, am talking about version upgrades. I looked into this at first thinking that it was something to do with this service, because this ddl is used for such a service. I have no idea whether I used BITS previously, but since one of the major dll files is inaccessible, and it is impossible to even update it with the latest (I also now have 64 bit version of this in SysWOW64 directory and the file is intact), I am certainly not not running the 32 bit version of the service.

Share this post


Link to post
Share on other sites

If it were my machine and I was having 'difficulties' with Win Updates and core windows files I would just do a clean install of Windows 10,.

Not a repair, or restore, just a clean install run from an iso (either on USB or DVD) of the latest Win 10 1909 build.

Create Windows 10 installation media from here

https://www.microsoft.com/en-gb/software-download/windows10

If you just want a local account don't have the internet connected when you do the actual install, if you use a Microsoft Account have the internet connected.

Share this post


Link to post
Share on other sites

Thanks for the suggestion, but this is what I want to try and avoid. I have, of course a backup of all my files but it is the hassle of having to reinstall all the software I have. 

BTW, I tried today using PrivaZer and it went through all the motions as if it was doing something useful, including removing the file name from its own browsable file list. But looking at the filesystem, I see that it is still "there". Is CCLean purchased edition able to do better?

On 04/12/2019 at 15:01, Augeas said:

Now you're saying something completely different. First you said that a system file was corrupted. What makes you think this? What other people have described this 'scenario'? Now you say that the MFT isn't 'intact'. Of course Recuva assumes an intact MFT, as does Windows and the user, it's the most critical file you will ever find, and the most securely protected. Nobody on this forum knows how Recuva's inner workings actually work, we can only second guess from our own experience.

Your understanding of CCleaner is incorrect. CC requests NTFS to delete a file, which it does by flagging the entry in the MFT as deleted. The entry is still there. The 'full edition' acts in exactly the same way. It's NTFS that deletes files, not Recuva. Entries in the MFT are never physically deleted, but flagged as deleted and subseqently reused.

I still don't really know what you're trying to achieve.

 

Share this post


Link to post
Share on other sites
5 hours ago, hazelnut said:

If it were my machine and I was having 'difficulties' with Win Updates and core windows files I would just do a clean install of Windows 10,.

Not a repair, or restore, just a clean install run from an iso (either on USB or DVD) of the latest Win 10 1909 build.

Create Windows 10 installation media from here

https://www.microsoft.com/en-gb/software-download/windows10

If you just want a local account don't have the internet connected when you do the actual install, if you use a Microsoft Account have the internet connected.

I appologise, in my last reply, I meant to quote Hazelnut.

Share this post


Link to post
Share on other sites

If what you want to do is to restore a damaged file then neither CCleaner nor Recuva is suitable. CC removes temporary files and Recuva copies deleted files, neither will bring a damaged live file back to undamaged condition.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...