Author Topic: clearing system volume  (Read 12375 times)

0 Members and 1 Guest are viewing this topic.

ady4um

  • Guest
Re: clearing system volume
« Reply #15 on: January 09, 2012, 07:25:44 PM »
Well disabling system restore (even with a reboot) and manual deletion of restore points would do the same.

@DavidR,

When you said "would do the same", I don't understand. I mean, to which exact procedure you are calling "manual deletion of restore points"?

TIA.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: clearing system volume
« Reply #16 on: January 09, 2012, 07:33:37 PM »
thanks guys for all the input.

You're welcome.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: clearing system volume
« Reply #17 on: January 09, 2012, 07:48:12 PM »
Well disabling system restore (even with a reboot) and manual deletion of restore points would do the same.

@DavidR,
When you said "would do the same", I don't understand. I mean, to which exact procedure you are calling "manual deletion of restore points"?

Manual deletion could take the form of A) using the System Restore, Creation of a new restore point and the Removal of Old restore points or B) from windows explorer {having changed folder settings to view them} and using the delete function for a specific restore point or multiple restore points.

All that is actually happening is the reference to them is removed and the space is marked as free, the data remains there, there is no function to overwrite the physical data space, no wipe process, nothing, nada.

The data remains until it is overwritten and could be recovered as there ate file recovery tools that do that, some very good ones which can recover some of the data even after being overwritten.

Windows System Restore doesn't do anything special when you disable system restore; it just removes the references so you can't use those restore points as they aren't listed so you can't select them. It doesn't run any security grade wipe function to physically obliterate the data.

So essentially it isn't any different from the deletion of a file within windows the file reference is gone and the space is marked as free.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

ady4um

  • Guest
Re: clearing system volume
« Reply #18 on: January 09, 2012, 08:17:48 PM »
DavidR,

The description of deletion of files is correct, but there is a little difference in the sense of the list of available restore points. If the user simply deletes the files (which needs special permissions so to get into "System Volume Information"), the list of restore points is left intact.

That is the "mirror" procedure that CCleaner performs. CCleaner leaves the actual files, and deletes the list of available restore points (except the last one). The actual files are deleted (using the usual method as you described) when the system eventually creates new points, while in the meantime the available points are not listed since CCleaner deleted the list (not the files).

The Windows utility for freeing space, or disabling System Restore, should perform both actions: clear the list of available points, AND delete the actual files in System Volume Information (using the usual method you described).

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: clearing system volume
« Reply #19 on: January 09, 2012, 09:57:12 PM »
What ccleaner does is hardly minor as essentially it is no different to what has been said, the data isn't deleted period by any of the methods, just the references.

Unless you go the extra mile and use wiping software the data still remains whatever method you use.

Quote from: ady4um
CCleaner cleans the list or restore points, so they can't be used after the cleaning, but the files are still left untouched in the HDD, so for the purposes of this topic, that's not useful enough.

So system restore isn't actually deleting anything other than the references, so for me nothing different to ccleaner, the references aren't there so the restore points can't be used and that really is what I feel is important, to prevent old software and possibly malware being restored.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

ady4um

  • Guest
Re: clearing system volume
« Reply #20 on: January 09, 2012, 11:13:08 PM »
What ccleaner does is hardly minor as essentially it is no different to what has been said, the data isn't deleted period by any of the methods, just the references.

Unless you go the extra mile and use wiping software the data still remains whatever method you use.

Quote from: ady4um
CCleaner cleans the list or restore points, so they can't be used after the cleaning, but the files are still left untouched in the HDD, so for the purposes of this topic, that's not useful enough.

So system restore isn't actually deleting anything other than the references, so for me nothing different to ccleaner, the references aren't there so the restore points can't be used and that really is what I feel is important, to prevent old software and possibly malware being restored.

DavidR, we are talking about two different things. You are talking about "references" of the file system (such as the FAT in a FATnn filesystem) when deleting any file. When CCleaner deletes the "list" of available Restore Points, no file is deleted in the System Volume Information, and no "reference to files" are deleted pointing to files in the System Information Volume.

CCleaner doesn't touch the files, at all. It only deletes the list of points, so you can't see it when you want to select some restore point (so to apply it), except from the last restore point. CCleaner doesn't touch the files and not the "reference to files" (i.e. in FATnn, the first reference to the first cluster where the actual file is located).

In other words, when the "Free Space" utility of Windows is used, or when disabling System Restore, the files are deleted (i.e. the first "reference" to the file is marked as available); but when using CCleaner, the entire files will still be there.

Meaning, after CCleaner, if you search the files in System Information Volume (with the appropriate permissions), you will still see the files (all the files representing all the restore points). But when using the "Free Space" utility or when disabling System Restore and rebooting, the same search of files should return just one set of files representing only one restore point (or none).

This means that, after CCleaner, avast would still find files in System Volume Information just as before, even when the restore points were "deleted" by CCleaner, and there should be not much more free space.

OTOH, when the files are actually deleted (i.e. their "references" in the FAT) using the "Free Space" utility or by disabling System Restore, there is in fact free space gained in System Volume Information. This is not accomplished when using CCleaner to "delete" the list of Restore Points.

In neither case the "deleted" restore points can be used (applied), but with CCleaner the real files will still be there.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: clearing system volume
« Reply #21 on: January 10, 2012, 12:18:35 AM »
CCleaner does delete files

To me that is quite clear what it seeks to do:
http://www.piriform.com/docs/ccleaner/using-ccleaner/removing-system-restore-points

Quote
You can use CCleaner to remove System Restore points (see below for details). Once you remove one, nobody will be able to restore the system to that point.

In the above link, why make any note at all if it didn't delete any.
Quote
Note: CCleaner removes references to the System Restore points, but may not actually remove all files related to each point.

But I give up with this nonsense, life it too short for semantics.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

ady4um

  • Guest
Re: clearing system volume
« Reply #22 on: January 10, 2012, 12:37:31 AM »
DavidR, I'm sorry you think this is nonsense. You may understand the consequences, but someone else may not (or not so clear).

In short: CCleaner removes the list so the restore points are no longer available, but not the System Volume Information files themselves. The user should use other more appropriate methods (also presented in this same topic) if the files themselves need to be deleted for whichever reason. The folder itself remains in any case.

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48523
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: clearing system volume
« Reply #23 on: January 10, 2012, 12:58:57 AM »
@ ady4um.
Sorry but all this bantering back and forth has accomplished is to totally cloud the
original question and the various methods offered to accomplish the task.  :(
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline MikeBCda

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2247
Re: clearing system volume
« Reply #24 on: January 10, 2012, 01:52:29 AM »
One would assume that if you're a fairly active user, even without wiping, any "free space" would probably get overwritten relatively quickly anyway.  So for us "normal" users, there's probably no real reason to wipe unless you're getting rid of the physical drive for whatever reason.

That's one of the nice things about using Puran defrag, it makes a point of, among other things, closing "holes" (small patches of supposedly free space) to in effect force such overwriting.
Intel Atom D2700, 2 gig RAM, Win 7 x64 SP1 & IE-11, Firefox 51.0
(default). 320 gig HD, 15Mb DSL, Win firewall, Avast 12.3.2280 free, SpywareBlaster, MBAM Prem., Crypto-Prevent

ady4um

  • Guest
Re: clearing system volume
« Reply #25 on: January 10, 2012, 03:15:25 PM »
@ ady4um.
Sorry but all this bantering back and forth has accomplished is to totally cloud the
original question and the various methods offered to accomplish the task.  :(

I agree, but I'm not the one mixing the method to delete whichever files in a certain filesystem (or now wiping a drive, or the defrag of files) with the different methods to achieve the deletion of the files in System Volume Information.

If someone still has any doubt, the 2 valid methods to delete those files are
A_ The "Free Space" utility included in Windows; or
B_ Disabling System Restore.