Solved How do files in ...\AppData\Local\Temp get deleted?

[JohnHa]

I am debugging an problem with an application which uses ...\AppData\Local\Temp to store its temporary files.

My questions are:

Q1 Does W7 ever automatically delete files from this folder?

Q2 Is each application supposed to delete the files it creates?

Q3 If Q2 is YES, are their known cases where a badly written application goes delete ...\AppData\Local\Temp\*.*? That would cause my problem as it would delete my temporary files.

I ask because the symptom of the problem I am debugging is that the application's temporary files in ...\AppData\Local\Temp suddenly get deleted which causes the application to lose data.

Note that the files being deleted are not "held open by the application" so there is no protection from their being deleted by another program. Also I know that cleaning programs can be scheduled to clean ...\AppData\Local\Temp but I am ignoring that for the moment - I want to know what W7 does.

Thanks

 

[UsernameIssues]

> Q1 Does W7 ever automatically delete files from this folder?
Not that I have ever seen.


> Q2 Is each application supposed to delete the files it creates?
In my opinion, apps should cleanup after themselves, but many apps do not.


> Q3 If Q2 is YES, are their known cases where a badly written application goes delete ...\AppData\Local\Temp\*.*? That would cause my problem as it would delete my temporary files.
I don't know of any "normal" apps that delete temp files that were created by other apps. Of course, apps that are designed to delete some or all temp files (e.g. CCleaner) will delete temp file created by other apps.


You can use Process Monitor to determine which app is removing the temp file of interest.

Set a filter for Path > contains > AppData\Local\Temp > Include

If desired, you can be more specific with the filter above. You can include one of the files that holds data of interest. If desired, you can add a a filter to include entries for every temp file of interest.

If need be, you can temporarily exclude the app that writes the data to these temp files. Right click on the app name and select exclude from the context menu. That should let you see any other apps that are acting on the temp files of interest.

If you need to let Process Monitor run for a long time, set a local backing file.
(Menu bar > Files > Backing Files...)

If you need more help using Process Monitor, search YouTube or post your questions here in this thread.


If need be, we can probably come up with a script that will alert you to when the temp files are deleted. Knowing the exact time of deletion might help you find the entries of interest within Process Monitor.

 

[JohnHa]

Thank you. Your reply has confirmed my suspicions.

I have been running some more tests and I found that CCleaner did not delete files - or at least not my application's files - in ...\Local\Temp so I shall have to look elsewhere in the application for my problem.

My initial thought was that it is slightly risky for an application to write temporary data files in such a common location where they can be "deleted by anyone" but on checking I found that the files are only able to be deleted by someone who has, or some application which has, Administrator privilege. Ordinary users only have Read and Execute permissions on my application's files.

 

[Baddog22556]

They are not automatically deleted unless your written app does it or programs like CCleaner
or Disk Cleanup specifically target those temporary files.

 

[LMiller7]

I don't believe that Windows would ever delete any of this folders contents except when requested by the user. I would consider it highly highly inappropriate to do otherwise. This folder is used by applications and it is their responsibility to manage their one temp files. Applications have varying definitions of what "temporary" means and may expect such files to exist for long periods of time. This is not recommended behavior but some do so.

My initial thought was that it is slightly risky for an application to write temporary data files in such a common location where they can be "deleted by anyone" but on checking I found that the files are only able to be deleted by someone who has, or some application which has, Administrator privilege. Ordinary users only have Read and Execute permissions on my application's files.

It's somewhat more complicated than that. A standard user can delete temporary files created by their own applications. An account is considered the owner of files they create and have full control over them, at least in this context. This is good, otherwise an application run under a standard account could not delete it's own temp files. There is nothing to prevent an application from deleting or overwriting files created by other applications run under the same account. Administrators can delete any temp files created by any account, including other administrators.

While an application is running it can lock a temp file for exclusive access. In that case even an admin could not delete them.

 

[JohnHa]

Thank you.

I have done some more work on the problem I am debugging (a word processing application where users sometimes lose the images in their document) and I can now replicate the symptoms exactly.

The application writes the images as individual files, one per image; and the text content etc; to ...\AppData\Local\Temp. The text content etc file is locked as being open, preventing it being deleted; the image files are not so locked. If I manually delete all files in ...\AppData\Local\Temp, simulating clearing \Temp, the text content file remains while the images are deleted. When the document is saved, the text content is OK but the images are lost.

This is exactly what users experience - they save a document and on opening it, some or all of the images are missing. Hence my wondering if something could be deleting the files.

 

[RolandJS]

Is this computer running any sort of PC-cleaner and/or any sort of bulldog-level privacy-guard software?

 

[Ztruker]

You can add that specific folder to CCleaner's cleanup list if you want.

 

[JohnHa]

Thank you.

I respond to forum posts from users so I unfortunately have little information about exactly what they did or are doing, or how their PCs are configured. They just report - very occasionally - they have lost images. It has been impossible to reproduce the fault.

I only thought of this as a possible mechanism today and am progressing it. I have about 25,000 WP files on my PC having used the s/w for many years and it has never happened to me, so I am grasping at straws.

I tried CCleaner, which I have, but the as delivered configuration it does not clear the ...\AppData\Local\Temp\ folder. I realise that other cleaning utilities might clear the folder.

 

[JohnHa]

You can add that specific folder to CCleaner's cleanup list if you want.

) That is exactly what I do not want the users to do!!!

 

[UsernameIssues]

... apps that are designed to delete some or all temp files (e.g. CCleaner) will delete temp file created by other apps....

...I tried CCleaner, which I have, but the as delivered configuration it does not clear the ...\AppData\Local\Temp\ folder. I realise that other cleaning utilities might clear the folder.

The "as delivered configuration" should clear the ...\AppData\Local\Temp\ folder...
...but only if the files are older than 24hrs old.










If I clear the option highlighted above, the files shown below will be deleted:




You should tell forum members to avoid clearing the folder via CCleaner.

 

[JohnHa]

Thank you for that correction. I had cleaned it manually myself before starting testing, so as not to confuse myself, so when I ran the CCleaner test, everything was less than 24 hours old. I have just placed an old file in it and CCleaner does indeed delete it.

 

[UsernameIssues]

No problem.

Let's hope that you can help others not lose their data in that temp folder

 

[HBaergroy]

Found it! It's Norton.

JohnHa: Did you ever find the solution?
I have exactly the same problem, and in my case it is caused by Norton Antivirus.

At irregular times, the temporary files of an application I develop get removed while it is running, and data are lost. Today it happened again, I once again searched the web for help and found this page, which notes that running Disk Cleanup will clear AppData temp folders. This alerted me to the fact that Norton AntiVirus had notified running in the background to improve system performance...

So I again started my application, opened the temp folder to watch, started Norton manually, ran Performance > File Cleanup and ... zap! Gone were the temp files.

This also explains why most of my users did not report the problem: fortunately most do not use Norton. Better antivirus software probably looks at the timestamps before removing temp files.

My solution will be to set work files read-only each time they are closed. (The application removes the temp files itself when ready.)

 

[Megahertz07]

My not be a good idea. To set work files read-only each time they are closed my prevent them to be updated. And Norton may also delete read-only and even system and hidden.
If the problem is Norton, disable the function on it.

 

[HBaergroy]

My application will set read-write permission when needed. Norton does not remove read-only files (I tested this). Also note that disabling the function in Norton is not the solution: I would have to tell all users of my application to do that.