Cannot overwrite deleted emails on free space

Page 5 of 5 FirstFirst ... 345

  1. Posts : 18
    Windows 7 Home Premium 64
    Thread Starter
       #41

    Well Callender and Slartybart, it's looking now like I was wrong about these emails I have been trying to get securely wiped. I just took for granted that the emails were in the free space of my C drive. Because hey, that is where most things are sent that has been deleted, and if you don't want them there just do a secure wipe of the free space and then the stuff is really gone for good.

    But, not Thunderbird emails. Yesterday I decided to check if Recuva could still see those emails after I recovered the back-up image I had done back in March of this year, and also after the recovery I wiped the free space with CCleaner. I run Recuva, and there those darn emails were just as they were before.

    So, I uninstalled Thunderbird, went and checked again and the emails were still there! OK, I thought about it for a while and decided to go look at the profile to see if the uninstall took that off also. And NO it did not. I moved the profile folder and the profile.ini to another drive I have. Then checked with Recuva.....Then the emails would not be found by Recuva!

    But, the trouble now is, I still can't find them, even though I know for sure they are in the profile somewhere. Opened the ImapMail folder, and looked through the Imap folder with all the emails using notepad text editor and still haven't found the ones I am hunting. I just can't figure out where Recuva is getting them from, as it don't give the address where they
    recovered them from.

    On recuva, I can select emails at a specific location and it has C:\ set as the default to search in, but on the browse button there, I set the profile folder to search in...and it will not find them there. The only way I have been able to get Recuva to bring them up, is to allow it to look in C:\. Then on the drafts folder properties that Recuva shows the emails to be in, it shows location as "Archive Root Directory". Ha, I cannot find that eather! I put Archive Root Directory in start/search and it brings up bookmarks.html.
      My Computer


  2. Posts : 4,776
    Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
       #42

    TB Profile


    Well it looks like you've managed to work out the following:

    Deleted emails are just marked as deleted by default rather than physically deleted as mention in Post #8

    Recuva has it's own way of recovering deleted emails. When you use Recuva it is looking at emails that are marked as deleted in your Thunderbird profile rather than using the way that it looks for deleted files that have been allocated their own space on your drive.

    Deleted file: Traces exist in free space and a few other places.

    Deleted email: There was no file to delete that existed separately on your drive. It just markes the maessage as deleted in your Thunderbird emails database but it's still there unless you tell Thunderbird not to delete messages or else compact the folders after messages have been deleted.

    I reckon that if you run a scan with other file recovery software it won't find this entry that gets created by Recuva unless you actually used Recuva to retrieve your deleted emails then deleted the folder that they were recovered into.

    Also you've managed to work out that simply running the Thunderbird uninstaller doesn't fully remove all trace of your profile as was mentioned earlier. You still need to clean up after removing Thunderbird to ensure that no trace of deleted emails exists.
      My Computer


  3. Posts : 4,776
    Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
       #43

    Suggestions


    Well here's my thoughts - you can decide if you agree.

    Try using a third party uninstaller to remove Thunderbird like this one:

    Download | GeekUninstaller

    Once it's finished doing it's thing - use it to also uninstall Recuva for good measure then reboot.

    Then check manually for any leftovers by setting folder view to show hidden files, folders and system files.

    Check the following locations and delete any Thunderbird files or folders if they exist.

    "C:\Users\Username\AppData\Roaming\Thunderbird"
    "C:\Users\Username\AppData\Local\Thunderbird"

    C:\Program Files (x86)\Mozilla Thunderbird
    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk"

    Check this folder and if it exists run the uninstaller contained in the folder:
    "C:\Program Files (x86)\Mozilla Maintenance Service"

    Do a file search for any files with the following extemsions and delete them if found: .msf & .sbd

    Reboot.

    Do a file search for any files with the following extemsions and delete them if found: .msf & .sbd

    Then open System Restore and delete all old system restore points. Then create a new system restore point.

    Wipe free space (again!)

    Reboot.

    Reinstall Recuva and try another scan for deleted emails. Let us know the results.
    Last edited by Callender; 03 Jul 2014 at 18:38. Reason: add info
      My Computer


  4. Posts : 18
    Windows 7 Home Premium 64
    Thread Starter
       #44

    Callender, I guess in my last post I didn't explain it like I should have. Anyway, I knew the emails were on drive C profile folder, but I just couldn't find them. So I used the recover program that one of you guys had reccomended to try...Email Recovery for Thunderbird" Ran it and it found the emails, but it also showed exactly where they were on drive C/appdata/profiles/local folders. I went to that folder, opened it and there they were. I then wiped them with AbsoluteShield File Shredder and they are now gone. Had no idea what they were doing in that folder, as that was a folder I had when I used OE and had just left it on here. Thanks to everyone on here who helped me with this.
      My Computer


  5. Posts : 4,776
    Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
       #45

    Well spotted! Local Folders indeed.... C/appdata/profiles/local folders
      My Computer


  6. Posts : 2
    XP
       #46

    I just wanted to add to this thread, that I am having the EXACT same problem as the OP.

    With the only difference being that the .zip file created is Outlook Express:

    See here:



    Did anybody solve this, as I also could recover the deleted file, and all my years old sensitive email data was in the zip file.

    Thanks in advance.

    Steven
      My Computer


  7. Posts : 4,776
    Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
       #47

    Outlook emails


    Hi Steven,

    Well I don't use Outlook on my machine - it's disabled in "Turn Windows features on or off" but that zip file doesn't contain anything until you attempt to recover emails. It's merely indicating that there are deleted emails that can be recovered.

    Your best bet is to ensure that emails really have been deleted from Outlook rather than just marked for deletion. Also from my point of view it's best to delete all available system restore points after you've deleted those old emails!

    Maybe someone else can give advice on cleaning up Outlook. Personally I've never used it except in a work capacity.

    Have a look at this for a start:

    How to Purge Deleted Messages in Outlook - About Email

    Also if you want to, try running these and see for yourself if it can find and recover that zip file:

    http://dmitrybrant.com/ntfswalker

    http://diskdigger.org/download

    Both programs need to be "Run as admin" or from an elevated shortcut.
    Last edited by Callender; 22 Jul 2014 at 13:21. Reason: Add info
      My Computer


  8. Posts : 2
    XP
       #48

    Thanks for the reply, Callender.

    I actually recovered the .zip file today just to see what was in it, and strangely, there are emails from yesterday in it, as well as emails from 2013, and I have definitely deleted system restore points this year, the last time being about 4 weeks ago.

    Looking in the zip folder, there does not seem to be any sequence. I mean there are a few from last year, a few from earlier this year, some yesterday, last week, etc. etc. No where near the amount of emails I receive (hundreds per week), so it is definitely odd, because if it were somehow a stored replica of the email content I have in outlook it would probably touch 1GB+, and it is nowhere near that.

    Unlike the OP I cannot delete Outlook Express (as old as it is) as I still use it for work, etc, but only Recuva seems to find it (definitely there though as like I said I restored the deleted .zip earlier), but Undeleteplus does not find it.

    It's definitely odd, almost like there is a connection to the current emails some how, and might be the reason it cannot be deleted.
      My Computer


  9. Posts : 18
    Windows 7 Home Premium 64
    Thread Starter
       #49

    Steven, if you want to wipe those sensitive emails from your harddrive, first... just go to your profile page and find the emails. Then use a free program like eraser to write over just those emails. Or, use the free download of Ccleaner. If you use that, just delete those emails from the profile page and if they get sent to the recycle bin, empty it. Then wipe your free space on your drive C...that is if C is indeed the drive, using at least the Advanced overwrite, 3 pass. CAUTION: BE SURE YOU HAVE ONLY FREE SPACE OF THE DRIVE CHECKED!

    I do not use Outlook Express anymore, but I still have the profile path to it using win xp, so it will be different for you as I am pretty sure you don't use win xp anymore. But with xp, my profile for OE was at:

    C:\Document and Settings\Username\Application Data\Identities\account_ID folder
      My Computer


  10. Posts : 4,776
    Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
       #50

    Outlook emails zip file


    Once again there's no actual deleted emails zip file regardless of what you think you're seeing in Recuva. It just means that it has found evidence of deleted emails that it can recover. It only begins that recovery process when you opt to recover the emails. Until that point there's no actual zip file - hence other recovery software doesn't find it.

    Try deleting the .dbx file mentioned here:

    Deleting Messages in Outlook Express Does Not Work

    Then set auto purge on all folders:

    Automatically Purge Deleted Items (Outlook FAQ)

    Then reboot and run Recuva again.
      My Computer


 
Page 5 of 5 FirstFirst ... 345

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 14:14.
Find Us