I have been using CCleaner for a while thinking it deleted internet files specifically. I ran Recuva today and found MANY picture files and others that were from the internet, even though I had ran CCleaner before. I have the 7 layer (NSA) level checked for overwriting, but if i go on the internet, close the browser, run CCleaner and then run Recuva it will pop those pictures i just saw on the internet up.

How do i get rid of them for real?

Which operating system? Which browser? Which version of CCleaner?

First the silly questions. Have you ticked the Tempoary Internet Files box on CCleaner?

What version of CC are you running (earlier versions did not overwrite temp internet files).

Hi, just read this post. I have recently downloaded Recuva and just encountered the same problem.

I a running CCleaner v2 03552 and have selcteed the 35 pass deletion and have been able to open deleted files. Even when they are a poor status. I am running vista home premium if that makes any difference.

Which browser?

In Internet Explorer, if you have "Empty Temporary Internet Files folder when browser is closed" enabled, the files are deleted by IE so CCleaner doesn't see them as files to be wiped. Also, if you have the size of the folder set too low, when it reaches capacity, old files get bumped out and you get the same effect.

If it's another browser, others may have suggestions.

Im using windows XP - CCleaner 2.01.507- I use Internet explorer 7 and the laterst version of Firefox and I have the temporary Internet Files box checked.

Any ideas?

Thanks!

Get a small harddisk for your OS!

Format that drive you use now with an external harddisk enclosure & then wipe it with that heidi eraser program.

Or, incinerate it, give it an acid bath, weld it to a lump, run over it with a train, sledge hammer it senseless, drill holes in the platters....

Use proper protection when following these extreme measures!

AMEN

davey

Can we stay on topic please here.

Users are asking for help with recuva/CCleaner software problems.

Just done a test myself. On 7 pass deletion, or 35 pass deletion, erased files can still be recovered using a recovery program. (Files deleted using "eraser" can't be recovered with this program.
It would seem, on the face of it, that CCleaner's secure delete feature is not effective.

Hello Tarq57,
Please explain how you did your testing.
You must not forget that CCleaner does not clean or secure delete files that have already been deleted
by some other program.It only secure deletes files that it CCleans.CCleaner was never designed to look for deleted files.
That function has been relegated to Recuva which will completely erase deleted files based upon user request.This is currently being tested and developed with member assistance and improvement suggestions being cosidered.
Eraser" erases files that have been only previosly deleted.
All designed to perform different functions.
Regards,
davey

P.S. This is not to deny that problems may exist,but to help explain some of the complexities involved in this testing process.
Your testing efforts are very well appreciated by the developers and other members involved with this testing process.

Hello Davey,
The version of CCleaner is 2.04.543.
I'm referring to files that CCleaner has deleted with a 7 (or 35) pass option selected. Those were the only two options tested.
The method (stumbled upon) was to delete the contents of a folder, not particularly large, about 5 files totaling about 4Mb.
(These files had not previously been deleted, erased, or otherwise messed with. They were a .mpg, a couple of jpegs, and some texts.)
Subsequently, out of curiosity, ran a program called "restoration", by Brian Kato, and was able to restore these "secure deleted" files intact.
Files that have been deleted (erased) using "eraser" (the program) were not recoverable, nor identifiable.
"Recovery" finds a lot of zero byte references, and names of stuff that once existed, but no more. But in the case of files deleted by CCleaner (in this instance, anyway) the full file name is there, and it is immediately identifiable, and takes but seconds to recover intact.

This is the only version of CCleaner that I know this has happened with. It possibly happened with earlier versions, but was not observed.

Some time ago I installed "Recuva", but ran into a problem that had also been previously reported, so uninstalled it. Not used it since.

Thanks Tarq57,
This gives us a good idea of your test.
How was this folder or individual files (5) set up for deletion.Include option? - Drag and drop 1 folder or 5 files? Drag and drop into a Temp file?
Please be specific.


What Cleaner options were selected?


How long did the Cleaner take to run.


What was shown in the Deleted files report?



All this information may help get a fix in the next version of CCleaner.
Thanks again for being an active member of the forum,
davey

1) Drag and drop one folder, into the "include" area in "options". In this case, it reads "D:\Incomplete\*.* which is the folder for partial Limewire downloads, any junk or unwanted (or dodgy misnamed) files I clear at the end of every browsing/p2p session. The contents of the folder, regardless of size, are thus deleted. (It doesn't amount to much, as I've mostly got the hang of what is likely to be junk vs wanted. Maybe 1-5Mb, usually.)

2) See screenshots. At the bottom of the second (applications) screenshot is a "Windows" section. The only item selected is "MS wordpad".

3) No idea, sorry. Nor have I kept a record. But it regularly, on cleaning, shows an amount cleaned commensurate with what I've been doing. [Edit] including D:\Incomplete.

Hope this helps.

When the files were securely deleted, did the file names remain unchanged or were they overwritten with ZZZZZZ.ZZ etc?

In the instance referred to, the file names - or at least some of them - remained. But I have seen the ZZZ etc you refer to appear in the search results for recovery.

use Recuva and recover all those pic files you wanna delete permanently in a new folder, then run Eraser on those files...

Now turn off your "Empty Temp files" feature in IE7 tools\programs...

keep this feature checked in CCleaner and check for any repition of the earlier mentioned problem..

That won't work, you'll just be erasing the recovered copies, the original recoverable files will still be on the disk till overwritten.

FWIW tomcat, I am aware that CCleaner will not erase already deleted files. The browser is not set to delete files on exit.

The answer you suggest doesn't match the problem description I've posted.

Any news/progress/instructions or requests on this, please?

Bump.

Hello Targ57,
I didn't mean to leave you the impression that there was any "official" members project as regards
secure deletion in CCleaner.
At the time of your testing there were other members doing testing and reporting their results.
This testing reporting does help the development team find specific and "bugs " that occur under circumstances that they can not be expected to test.Our feedback is important especially after new versions are released.
Have you had time to do any tests in this regards since the last release? v 2.05.555?
Have you noticed any improvements in secure deletion performance.I heard that they planned to include
wiping or changing of the original file name.
I don't do as much daily volume cleaning as you do.
I am sure they wouldn't mind getting some more feedback.
Thanks for your past testing reports.
davey

Thanks for replying. Had not realized there was a new release, shall download and try it out.

OK, tried it out, just downloaded something (a jpg) to "D:\Incomplete, ran the latest version of CCleaner, 7pass deletion, one of the files was fully recoverable. Another was listed as ZZZZ.ZZ, and not able to be read. That's the limit of the test so far.
Is there a setting in the program that could be affecting its performance?
How many others have experienced this?
And I wonder how many unknowing users would find this occurring if they tested for it.

Hey Tarq57,
Thanks for testing so soon.
How many files were in that folder? Two?
The first in the directory unrecoverable and the last recoverable or vice-versa?
davey

There were two zero-byte files and a .dat file, which I didn't try to restore, a preview of a jpg, which was restorable, and the full version (complete) of same, which was the ZZZ file, and didn't display anything when restored and then opened.

I'm confused. How many files were there in the d:\incomplete folder? One? Where do the other deleted files come from? If these files weren't in the incomplete folder then they wouldn't be overwritten, would they? Did CC successfully overwrite your jpg in the incomplete folder and the other files you have found were deleted by other means?

Sorry if not clear.
There were five files originally in the folder. A .DAT file, two entries for files selected that Limewire failed to connect to and thus download, a preview (or part downloaded) file, and the final fully downloaded version of same. (I had just selected a random word in the search terms, and selected 3 downloads at random, as a test.)
Only the last two were selected to be restored. The preview, or part file (.jpg) was fully restored, the full one was "restored" as a non-viewable ZZZZ.ZZZ file.
No other delete/erase method was used. The files were selected to be deleted (x7) by CCleaner only, and immediately following that (and CCleaner indicating in its report that the files had been deleted) Restoration was run, for the drive the folder is in.
This is a preliminary test only, so not exhaustive at all, but indicative enough for me.

Thanks for that. I'm happy that CC has securely deleted the large jpg. I'll have a think about the others, being in the MFT, not being renamed, etc. (rather busy at the mo). Rgds.

Hi,

Back from the pub. Right. Tarq, you mention that the large file renamed ZZZ could be restored but not read, exactly as should be expected. You're happy with this, I assume?

The other four files: I think we can discount the two zero-byte files, as they can neither be erased nor recovered. So that leaves the jpg preview and the index.dat file. If you have Recuva installed (as all good CC users should) then can you:

a) Look at the info section on these deleted files. Does it say that they have been overwritten? I would not expect this to be so as they are freshly deleted files, but it's good to check. In any event they wouldn't have been overwritten when you ran CC.

(b with ) shows as a smiley) You can look at the header info but I don't think this will show anything of value at this point.

c) Try the secure delete option (single overwrite) on these deleted files. If there is an error message saying that they can't be deleted as they are in the MFT then that explains why CC can't touch them. MFT entries are 2k so small files (after allowing for MFT info such as name, date, etc) can be stored in the MFT itself, and are thus untouchable. If they can be deleted then the header section will show zeroes and the preview for the jpg will disappear. Personally I don't think that either of your files will be small enough to fit in the MFT.

d) Report back. Rgds.

Hi, Augeas.
(Very pleased to see that your priorities are similar to mine. Always pub first.)

I don't have Recuva installed. Tried installing it 3 or 4 months ago, would not start at all, 'twas related to a known bug, according to the forum post I can't find at the mo, sorry.
I use "Restoration" by Brian Kato. That's the program that has found the files mentioned. Also use "Eraser". (But wasn't in the test described.)

I'll have to run some kind of test again, the contents of that folder have been repeatedly used or overwritten since the test.
Have just downloaded the latest version of Recuva, assuming it works I'll try it all out as you suggest, get back, probably in a day, maybe 2.

Is there a way of viewing the contents of the MFT? (and editing same)?

I'm sure there is, but not with anything that I have installed. This looks interesting...

http://www.cnwrecovery.com/

Update.
Installed (successfully) latest Recuva version. Played a round with it a bit (as you do) to work out what it does (or not), seems quite an effective application. Very nice. (Congrats.)
So. Testing CCleaner, same method as earlier. Downloaded a few files to D:\Incomplete, using p2p. Some jpg/jpeg's, a mpg, a couple of mp3's.
(with the p2p program, comes the opportunity to "preview" part downloaded files, I guess so you can check you're getting what you expect to. Previewed files are created in the same folder, and are, as suggested, incomplete versions of the full download. So for example, you'll get half a picture, or 1/4, or the first few seconds of video, or song etc.)
Closed the p2p. Ran CCleaner. (7 pass.) Ran Recuva. All the previews of the files were able to be recovered, in excellent condition. All the others were ZZZZZ.ZZZ etc, recoverable but (apparently) not viewable.
So that's where we're at.
Haven't tested CCleaner with other files at all, such as temp. internet files etc, but the above test is proof to me that in some circumstances, Cceaner does not properly erase files.
Hope that helps.

Hi Tarq57,
Thanks again for taking the time to do testing.
As regards these "preview" files how many end up in the MFT?
All of them and they are recoverable?Viewable?
Some of them and the others not in the MFT are unrecoverable?Viewable?
davey

1) I don't know how many of them "end up" in the MFT. I assume all of them have some kind of reference within the MFT, at least until that is overwritten in the normal course of events.
Selecting "secure delete all" (from a partition, not just the incomplete folder) results in a few entries unable to be deleted, because the MFT is where they were.
2) All the preview files tested were recoverable and viewable. Anything with a ZZ in the name (ie: without a file extension indicated, or an extension that reads ZZZ) are sometimes recoverable, but I haven't been able to view them in any of the applications selected (Windows picture and fax viewer, WMP, Media Player Classic, Notepad.)

How do I find out "how many end up in the MFT"?

Only way I know of is to attempt "secure delete" in Recuva.It will come back saying it couldn't because it is in the MFT.
Augeas may have another method.

I think you flatter my skills, Davey! I have noticed, by looking at deleted files with Recuva, that those secureley deleted by CC which are in the MFT are overwritten with zeroes (I only do one overwrite). However if you select secure delete on these files with Recuva it will fail, as the file is in the MFT. That leads me to conclude that CC does something simple such as overwrite the file to be deleted with zeroes, rename it, and then delete it. That's given away a few secrets. Recuva, on the other had, possibly can't do the same trick, as it would have to manipulate the MFT directly instead of using operating system (Windows) read/write/delete commands. Overall, I'm rather glad Recuva doesn't try to tweak the MFT.

A day or so ago I had to securely delete some 50 gb of old data, a large amount for me, a load of old backups I was consolidating. When this was done I checked with Recuva and found about four files which hadn't been renamed or overwritten. I securely deleted them (except for one which was in the MFT!) and eventually these files were overwritten by new files. I wonder if some files are in some way unavailable to CC when it runs? Either locked, or in the swap file, or yet to be committed to disk? I don't know, just speculating.

It all keeps the brain active, what few cells are left.