Solved Cannot overwrite deleted emails on free space

[sabruffian]

Callender: Just a thought but perhaps try running Recuva with the recover deleted emails option one more time once you've cleaned up Thunderbird just to see if it creates a new zip file!

Well, what it did was the Thunderbird emails.zip in the free space is now 480mb instead of 234mb. So, when I deleted the profiles and profile.ini, recuva just added that to the Thunderbird emails.zip folder. Thunderbird emails.zip is not on the C drive anyplace except the free space.

I don't think system restore will change what is in the free space, but I will try that also. I thought at first it was because I have an SSD drive. But others on the recuva forum who are having this same problem have a regular hard drive.

 

[Slartybart]

Problem with Recuva 1.29 and Thunderbird emails.zip - Recuva Discussion - Piriform Community Forums

Posted 30 July 2009 - 04:47 AM

This file is due to the new feature in 1.29 which allows recovery of deleted Thunderbird emails. This file doesn't actually exist until you recover the files, that's why you can't overwrite it.
The file will consists of all the recoverable deleted Thunderbird emails in .eml format.

MrRon

 

[Slartybart]

Piriform - Recovering deleted emails

To recover deleted emails using Recuva:
1.Do one of the following:
Using Recuva's Wizard mode: On the File Type pane, specify Emails as the type of file Recuva should search for.
Using Recuva's advanced mode: To specify what Recuva should search for, use the filter drop-down next to the Options button to select Emails.
2.Once Recuva has produced a list of files, you will see the ZIP file or files in the results list.
3.Recover them using the normal process.
4.Use a ZIP program (such as WinZip, 7-Zip, or Windows' built-in Compressed Folders utility) to open the ZIP file or files.
5.To view an email, double-click the .EML file. The email displays in your default desktop email application.



Depending on the email program, you may also be able to import the EML files back into the program's database. Consult your email software's documentation for more information.

Note: You cannot securely delete the ZIP file in Step 2 before you recover it. Recuva only creates the ZIP file when you choose to recover the emails.

It is a very odd recovery method, but it's been done on your system. If you want to remove that "file" you have to complete the recovery process that creates a real zip file.

There's also this on Mozilla's page which recommends cleaning up Thnderbird (inside Thunderbird) and stop using Recuva to recover eMail.
https://support.mozilla.org/en-US/questions/993084

 

[Callender]

Sdelete

Whoops! Well that hasn't helped at all! Sorry about that.

I did a little more digging and it's also an issue that's been reported on the Sdelete forum so even if you got Sdelete running it wouldn't wipe the file.

Here's another suggestion but again it's not guaranteed to work.

One word of warning - this is really best suited to advanced users but I'll try to post instructions that can be followed.

Try downloading and running PrivaZer portable version but be very very careful with settings configuration.

See this post for an idea of the pitfalls:

http://www.sevenforums.com/software/316912-privazer-pc-cleaner.html

So run the program and choose "Go to main menu" then switch to "Advanced User" mode then choose "Scan in depth" and "Computer" then make sure that drive C is the only drive selected in the drop down window.

Check only the first 4 boxes and leave every other box unchecked other than "Start Cleaning" and "Shut down after cleaning"

Then click "Scan" and let it do it's thing.

Whatever you do - don't choose any of the other options!

There's a reasonable chance that it will reset every sector in free space.

It will take some time so make it the last thing on your list or leave it to run when you want to sleep.

 

[Slartybart]

This is probably the best explanation:
How to overwrite a Thunderbird emails.zip file with recuva - Recuva Discussion - Piriform Community Forums

OFFLINE Augeas
Moderator
Posted Today, 04:58 AM

There's something wrong with the comprehension here.

The zip file that Recuva shows in its scan does not physically exist.
It can't be deleted, securely or otherwise.
It is there to tell you that Recuva has found some deleted emails which can be recovered.

When you recover this file, a zip file will be created in whatever folder you recover to.
This zip file holds a copy of the deleted emails
The zip file shown by the Recuva scan remains in its non-existent state.

The deleted emails still remain in TB's data bases.

The zip file shown in the Recuva scan does not contain any emails, and cannot be used to delete emails from your TB email client.
It is only used to recover deleted emails.
If you want to remove deleted emails then forget Recuva, forget wiping free space, and turn to Thunderbird.

Have a look at Keep Thunderbird from building too big a nest on your hard disk - TechRepublic

or in even more detail Compacting folders - MozillaZine Knowledge Base

I agree - no utility is going to remove a file that doesn't exist.

 

[Callender]

More ideas

Slartybart is on the right track as usual and you'd do well to follow his advice.

One more thought:

It might be possible to image your drive using Macrium Reflect then use a linux based partitioning tool to delete your windows partion and then create a new parttion for windows and restore your Macrium Reflect image.

I really wouldn't feel comfortable on helping you with this and don't actually know if it's possible as although I've deleted windows partitions for reinstall purposes I've never restored an image to a newly created partition!

 

[Callender]

Edit: Forget that last post

It seems that the real solution might be to ensure that deleted emails are not stored in any Thunderbird database like the way it's set up on my machine. I've just tried again to recover any deleted emails using Recuva and it comes up blank - nothing found.

Maybe you'd never see that zip file in Recuva serach results again.

Should read "Entry" rather than zip file as explained by Slatybart!

 

[Slartybart]

Slartybart is on the right track as usual and you'd do well to follow his advice.
.....

Thanks Callender, but it took a while to wrap my head around it. I posted a few times before I found the post by Augeas. I've used Recuva in the past, but never with Thunderbird.

It's an interesting recovery method that Recuva employs, one that confuses just about everyone it seems.

So the key information is

• Thunderbird only marks eMail for deletion in it's database.
  
• Recuva uses Thunderbird's database to 'recover' deleted eMail.
  
• Recuva lists the files it finds in Thunderbird's database marked for deletion in a "ghost" zip file
  
• A real zip file is created when you actually recover those eMails, but the "ghost" zip file remains
  
• Cleaning up Thunderbird periodically will remove the eMail marked for deletion from it's database
  
• edit: per Callender's test -> changing Thunderbird's configuration to NOT store deleted eMail and running Recuva again removes the "ghost" zip file "created" by Recuva.
  I suspect the same thing might happen if you run the cleanup maintenance on Thunderbird..

I'm not sure, but I think there's an option to include or not include searching for deleted eMail in Recuva.
Unless you are looking for lost eMail, I suggest not using that feature in Recuva.

This was a great thread that will make it easier to explain if this comes up again.

Thanks sabruffian.

Bill
.

 

[sabruffian]

Slartybart, thanks for your input on this. You said...The zip file shown by the Recuva scan remains in its non-existent state.Well, it can still be seen and read by anyone who has access to my PC. Yes, I now know how they should have been deleted, and how to set Thunderbird, thanks to Callender. But that only helps in the future.

Oh, I could do a secure erase with samsung magician which came with their ssd drive that I have, and then reinstall windows 7, but was sure trying to not have to do that. I thought going back and doing a system restore might get rid of it, but no luck there either. Normally, files in the free space would be ok but not these. Many thanks for all the help I have gotten on here. But, I do see now there is just no way to overwrite Thunderbird emails.zip from the free space.

 

[Slartybart]

Before you go through all of that trouble.

Try what Callender suggests in post# 27.
Turn off deleted eMail retention in Tbird
Run Recuva

The file is gone per Callender's testing.

You can turn deleted eMail retention in Tbird back on afterwards if you choose.

It helps now and in the future.

 

[Callender]

One last attempt to explain

Hi again Sabruffian.

That zipped file isn't really there - it's an entry posted by Recuva to show you that emails are available to be recovered. They don't actually already exist in that non-existent zipped folder. They exist in databases that are contained in your Thunderbird profile. When you click that entry in Recuva it activates whatever method Recuva uses to extract deleted emails from your Thunderbird profile and then places them in a real zip file for you.

This is also evidenced by the fact that when you copied your Thunderbird profile for test purposes the number of emails/ file size that was detected by Recuva doubled - yet there were no additional deleted recoverable files present in free space.

Hopefully this helps you to understand. If not consider the following:

Thunderbird is free so there's no harm in fully removing it, rebooting and doing a cleanup with Ccleaner or BleachBit.

Once Thunderbird has been removed and you've cleaned up try running the recover deleted emails option in Recuva again. This assumes that you securely deleted the zipped folder that you actually recovered the emails into in the first place. If you didn't - wipe free space once more before running Recuva.

Or even consider trying other decent data recovery software and focus on deleted files with the .zip extension.

Here's what I use as an alternative to Recuva when I feel like I need a double check.

Lazesoft Recovery Suite Free, Free Windows System Recovery, Free Data Recovery, Free Windows Password Recovery, Free Disk Clone

You can install it on Windows and run it from there. You don't actually need to create a recovery USB/ CD in order to use it.

Start the program and choose the data recovery option then in the window that opens choose the file recovery option. Select drive C and let it search for deleted files.

Use the "File Type" filter to only display deleted .zip files. You can compare the results to your Recuva scan.

 

[sabruffian]

Hello again Callender. OK, I uninstalled Tbird and did a free space wipe with ccleaner. Then Checked the free space with recuva and the emails are still there just like they were. When I first recovered those emails, I recovered them to a storage drive I have. Then after I run eraser and wiped them off of that drive, they didn't show up on the free space with the others. The Ccleaner I have will only wipe free space or the entire drive. That is why I used eraser as it will wipe files and or folders if you don't want all of free space cleaned up.

What I am not understanding is y'all keep saying that Tbird emails.zip are non existant and is really not phycially there in the free space. It is for sure not in the Tbird database nor anywhere else on my C drive.. Anyway, last night I found an image on one of my storage drives of my win 7 C drive that windows had made a backup of back in March. I had forgotten about doing that. So was wondering if I recovered that image would that clear my problem up on the free space. I had tried system restore yesterday, and that didn't work. If I can ever get it off, I will just have to delete emails like you said to yesterday from Tbird. I noticed all your screenshots are gone about that though.

 

[Callender]

Emails.zip

Well what I'm asking is why do you think that Recuva suddenly reported that the file size doubled when all you actually did was copy your Thunderbird profile folder?

If you think about it there are two possiblities.

1). That the file doesn't really exist in free space and you could think of it as a "link" that when clicked on activates recovery of deleted emails from your Thunderbird Profile

2). There really is a deleted emails zip file that gets created by thunderbird when you delete emails.

As for it still showing up after removing Thunderbird and wiping space:

Just out of curiosity check the following stuff. Set folder options to show hidden files.



Set the options for the two highlighted items as shown and click "Apply"

Then try navigating to:

C:\Users\USERNAME\AppData\Roaming\Thunderbird\Profiles\PROFILENAME.default

See if there's anything there that looks similar to this:



That's where your emails are stored.

Other than that have you ever made a Thunderbird backup using other software or by copying your profile folder? If so - delete the backup(s).

Also see: How Thunderbird handles deleted messages

EDIT
If all trace of Thunderbird has been fully removed, any backups deleted, old profiles or copies of them deleted, recovered email zip deleted and everything securely overwritten - Recuva should not show any results for deleted emails.

Use a file search utility to search for any files on your hard drive with .msf of .sbd extensions.

Previous screenshots - I didn't delete them and can still see them when logged into SF.

 

[Callender]

Data recovery

Also in that decription of Lazesoft Recovery Suite - I got it slightly wrong. What you'd be lloking for is "Lost Files" rather than filtering results by file type!

 

[Slartybart]

sabruffian,

I'm having a hard time understanding where you are seeing the .zip file - you keep mentioning free space and that doesn't clear it up for me.

Please post screen shots of what you see and describe what you're using to see it.
See: http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

Using Callender's image it can be as simple as
I see the file in Explorer and I have the view set to show hidden file and not hide system protected files.

If you see the file only in Recuva, please state that and post an image on Recuva.

 

[sabruffian]

OK Slartybart, what I am calling free space is the space on my C drive that shows there is nothing in it, but as I'm sure you already know that files that you delete are not really deleted and can be recovered and or viewed by anyone who has access to your computer and the right tools/software. And the emails I had deleted is showing up in the free space using recuva. When I went to the free space I didn't go to recover any files I just wanted to look and see what had not been wiped permanetly...that is when I found those flippin' emails that I could open and view. I have always tried to keep that space erased so no one could see what was on there. Malware, trojans or any one with access can look. That is how someones ID can be stolen and used, along with credit card numbers etc....plus emails!! I thought my software eraser had wiped them but I was wrong.

Sometimes I wish I had not gotten a SSD drive, even though the TRIM feature supposed to do away with deleted files as soon as they are deleted, but it does not work that way. Now, every time I try to use ccleaner, cyper, eraser or any of the orthers they throw up big red flags saying...are you sure you want to overwrite this ssd drive free space, it could damage the drive. I have read that if you don't do it real often it will be ok.

OK...Here is what I have done. I recovered the backup image that windows did for me back on March 30th. Before I did that I uninstalled Tbird. I new The one I had in March would be on the image. And yes it was. It had 640mb of email etc on it. One folder in the profile where Tbird keeps everything had 238.24 mb in it, which is exactly what was in the zip file recuva found. It couldn't have been those though, or they wouldn't have been in the recovered image.
I compacted and set the Tbird settings like Callender said to set them. I have installed the Lazesoft recover software but haven't used it yet. I don't feel like Tbird emails.zip should be there now, but don't really want to use recuva to go look. I may just use Lazysoft and see what is there after I wiped the image free space with Ccleaner.

 

[Slartybart]

Thanks, I still think there is some misunderstanding of the recovery. Let me try to unravel your post. I would have preferred images.

The only time you see the zip file is in Recuva - right?

No files were actually recovered - you only looked to see what could be recovered - right?

You could open the deleted eMails.... in Recuva? This is where you lose me.

It's probably a moot point since you don't want to run Recuva, but if you exclude eMail recovery then you won't see the .zip file in Recuva.

Sounds like you solved it then, glad you worked it out.

Bill
.

 

[Callender]

Compacting Thunderbird Folders

Okay so have a go at the following (in order to prevent any further recovery issues)

Compacting folders - MozillaZine Knowledge Base

If you're using IMAP it's easy:

Compacting folders - MozillaZine Knowledge Base

Don't set Thunderbird to move deleted messages to trash and don't synchronize your trash/ deleted emails folder on the sever with Thunderbird.

Compact all folders manually on a regular basis anyway just to be on the safe side.

Here's more screenshots:

Tools> Account Settings> Server Settings



Tools> Account Settings> Synchronization & Storage



Click the advanced tab and remove any ticks in folders named Trash, Bin, Deleted and so on. Expand each folder to be sure that you didn't miss something.

Tools> Options> Advanced (also clear the cache)



Hopefully that covers it!

 

[sabruffian]

Slartybart, yes I could open the emails and read right there in Recuva. And yes, I did recover them to a storage drive just to try and fig out what was going on with that. But later I got rid of them with AbsoluteShield File Shredder. Then when I looked at free space with recuva to see if the zip file doubled, well it did not, so the shredder got rid of those I recovered. But later when I deleted the profiles in Tbird, then...those showed up in that zi[ that had been on there. When I first found the Tbird emails.zip it showed showed 234.24 mb in it. After the profile was deleted (that I had backed up) the zip file on free space showed 472.50 mb in it the last time I looked before restoring the image with windows. I am going to look at the free space again later today now that I have wiped free space with ccleaner.

Callender....Thanks for the screenshots, I went backand found your post where you posted them and made the changes to mine, well, all except the server settings you put in your last post, and have changed that now, so should be in good shape with Tbird now except...when I do want to delete and emails, do I have to go to profile and do it? Didn't know for sure if compacting would delete any or not, or just make them smaller. Thanks a bunch for all y'alls help and suggestions.

 

[Callender]

Deleting emails in Thunderbird

Well the way I use Thunderbird it's set not to delete anything on the server. If I delete a message in Thunderbird with all settings set as shown in the screenshots then it vanishes from Thunderbird and doesn't reappear but it does remain on the server. It doesn't move to the "Bin" or "Trash" folders in Thunderbird and isn't recoverable using Recuva.

Compacting folders will remove deleted messages and reduce their size.