Cannot overwrite deleted emails on free space

Problem with Recuva 1.29 and Thunderbird emails.zip - Recuva Discussion - Piriform Community Forums

MrRon (A) Pririform said:

Posted 30 July 2009 - 04:47 AM

This file is due to the new feature in 1.29 which allows recovery of deleted Thunderbird emails. This file doesn't actually exist until you recover the files, that's why you can't overwrite it.
The file will consists of all the recoverable deleted Thunderbird emails in .eml format.

MrRon

Piriform - Recovering deleted emails

Recuva said:

To recover deleted emails using Recuva:
1.Do one of the following:
Using Recuva's Wizard mode: On the File Type pane, specify Emails as the type of file Recuva should search for.
Using Recuva's advanced mode: To specify what Recuva should search for, use the filter drop-down next to the Options button to select Emails.
2.Once Recuva has produced a list of files, you will see the ZIP file or files in the results list.
3.Recover them using the normal process.
4.Use a ZIP program (such as WinZip, 7-Zip, or Windows' built-in Compressed Folders utility) to open the ZIP file or files.
5.To view an email, double-click the .EML file. The email displays in your default desktop email application.



Depending on the email program, you may also be able to import the EML files back into the program's database. Consult your email software's documentation for more information.

Note: You cannot securely delete the ZIP file in Step 2 before you recover it. Recuva only creates the ZIP file when you choose to recover the emails.

It is a very odd recovery method, but it's been done on your system. If you want to remove that "file" you have to complete the recovery process that creates a real zip file.

There's also this on Mozilla's page which recommends cleaning up Thnderbird (inside Thunderbird) and stop using Recuva to recover eMail.
https://support.mozilla.org/en-US/questions/993084

Whoops! Well that hasn't helped at all! Sorry about that.

I did a little more digging and it's also an issue that's been reported on the Sdelete forum so even if you got Sdelete running it wouldn't wipe the file.

Here's another suggestion but again it's not guaranteed to work.

One word of warning - this is really best suited to advanced users but I'll try to post instructions that can be followed.

Try downloading and running PrivaZer portable version but be very very careful with settings configuration.

See this post for an idea of the pitfalls:

PrivaZer PC cleaner

So run the program and choose "Go to main menu" then switch to "Advanced User" mode then choose "Scan in depth" and "Computer" then make sure that drive C is the only drive selected in the drop down window.

Check only the first 4 boxes and leave every other box unchecked other than "Start Cleaning" and "Shut down after cleaning"

Then click "Scan" and let it do it's thing.

Whatever you do - don't choose any of the other options!

There's a reasonable chance that it will reset every sector in free space.

It will take some time so make it the last thing on your list or leave it to run when you want to sleep.

This is probably the best explanation:
How to overwrite a Thunderbird emails.zip file with recuva - Recuva Discussion - Piriform Community Forums

Augeas (a) Piriform forum said:

OFFLINE Augeas
Moderator
Posted Today, 04:58 AM

There's something wrong with the comprehension here.

The zip file that Recuva shows in its scan does not physically exist.
It can't be deleted, securely or otherwise.
It is there to tell you that Recuva has found some deleted emails which can be recovered.

When you recover this file, a zip file will be created in whatever folder you recover to.
This zip file holds a copy of the deleted emails
The zip file shown by the Recuva scan remains in its non-existent state.

The deleted emails still remain in TB's data bases.

The zip file shown in the Recuva scan does not contain any emails, and cannot be used to delete emails from your TB email client.
It is only used to recover deleted emails.
If you want to remove deleted emails then forget Recuva, forget wiping free space, and turn to Thunderbird.

Have a look at Keep Thunderbird from building too big a nest on your hard disk - TechRepublic

or in even more detail Compacting folders - MozillaZine Knowledge Base

I agree - no utility is going to remove a file that doesn't exist.

Slartybart is on the right track as usual and you'd do well to follow his advice.

One more thought:

It might be possible to image your drive using Macrium Reflect then use a linux based partitioning tool to delete your windows partion and then create a new parttion for windows and restore your Macrium Reflect image.

I really wouldn't feel comfortable on helping you with this and don't actually know if it's possible as although I've deleted windows partitions for reinstall purposes I've never restored an image to a newly created partition!

It seems that the real solution might be to ensure that deleted emails are not stored in any Thunderbird database like the way it's set up on my machine. I've just tried again to recover any deleted emails using Recuva and it comes up blank - nothing found.

Maybe you'd never see that zip file in Recuva serach results again.

Should read "Entry" rather than zip file as explained by Slatybart!

Callender said:

Slartybart is on the right track as usual and you'd do well to follow his advice.
.....

Thanks Callender, but it took a while to wrap my head around it. I posted a few times before I found the post by Augeas. I've used Recuva in the past, but never with Thunderbird.

It's an interesting recovery method that Recuva employs, one that confuses just about everyone it seems.

So the key information is

• Thunderbird only marks eMail for deletion in it's database.
  
• Recuva uses Thunderbird's database to 'recover' deleted eMail.
  
• Recuva lists the files it finds in Thunderbird's database marked for deletion in a "ghost" zip file
  
• A real zip file is created when you actually recover those eMails, but the "ghost" zip file remains
  
• Cleaning up Thunderbird periodically will remove the eMail marked for deletion from it's database
  
• edit: per Callender's test -> changing Thunderbird's configuration to NOT store deleted eMail and running Recuva again removes the "ghost" zip file "created" by Recuva.
  I suspect the same thing might happen if you run the cleanup maintenance on Thunderbird..

I'm not sure, but I think there's an option to include or not include searching for deleted eMail in Recuva.
Unless you are looking for lost eMail, I suggest not using that feature in Recuva.

This was a great thread that will make it easier to explain if this comes up again.

Thanks sabruffian.

Bill
.

Before you go through all of that trouble.

Try what Callender suggests in post# 27.
Turn off deleted eMail retention in Tbird
Run Recuva

The file is gone per Callender's testing.

You can turn deleted eMail retention in Tbird back on afterwards if you choose.

It helps now and in the future.