Disk Cleaner - what did it delete ?

[dave xnet]

Hello,
I used the MS disk cleaner, selected temporary files and temporary
internet files.
After it was done, I found out that it had deleted some big
media files in the c:\ root folder.
These were 150MB or so AVI files. It happened once before,
but I put it down to gremlins. Now it's happened again,
about three months later.

How to troubleshoot. What are the folders it's looking at?
Surely it shouldn't be the root ?

Dave

 

[Guest]

Hi Dave,

I had a look at what types of files disk cleanup does remove and technically
your media files shouldn't be removed. Unless possibly you renamed them to
..old files or stored them in a temp directory...

This is only my theory , but I would recommend rather storing the files in a
folder and then test , possibly also check the disk for fragmentation and
even viruses.

I haven't a single clue why disk cleanup would result in the loss of your
media, I'll be curious to find out what does cause this though ?

 

[Wesley Vogel]

Are you sure they were in c:\root folder?

Do you actually have a c:\root folder?

They were probably in...
C:\WINDOWS\Temp
or
%userprofile%\Local Settings\Temp
or
%userprofile%\Local Settings\Temporary Internet Files
or
%userprofile%\Local Settings\Temporary Internet Files\Content.IE5

Description of the Disk Cleanup Tool in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310312

Explains the available options for Disk Cleanup...
How to Automate the Disk Cleanup Tool in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;315246

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[dave xnet]

Hi Dave,

I had a look at what types of files disk cleanup does remove and technically
your media files shouldn't be removed. Unless possibly you renamed them to
.old files or stored them in a temp directory...

This is only my theory , but I would recommend rather storing the files in a
folder and then test , possibly also check the disk for fragmentation and
even viruses.

I haven't a single clue why disk cleanup would result in the loss of your
media, I'll be curious to find out what does cause this though ?

Thanks for the info. That's the trouble with this tool.
No LOG. Difficult to tell exactly what it's doing.
I looked in the registry at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary
Files.
There was this item:
"Folder"="C:\\WINDOWS\\TEMP\\"

Not sure why it was even pointing there.

They were definitely AVI files in the root.
To add insult to injury, I was unable to undelete them
using a third party program. They were there, but already
overwritten.
Dave

 

[David Candy]

HOW did you get that path you show. What did you do to find it.

 

[dave xnet]

Are you sure they were in c:\root folder?

Do you actually have a c:\root folder?

They were probably in...
C:\WINDOWS\Temp
or
%userprofile%\Local Settings\Temp
or
%userprofile%\Local Settings\Temporary Internet Files
or
%userprofile%\Local Settings\Temporary Internet Files\Content.IE5

Description of the Disk Cleanup Tool in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310312

Explains the available options for Disk Cleanup...
How to Automate the Disk Cleanup Tool in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;315246

Hello - by root I simply mean the highest level - C:\

Dave

 

[dave xnet]

HOW did you get that path you show. What did you do to find it.

I used regedit at the location specified. That path was hard coded
in the "Folder" item. I exported the item and that's how it looks in
REG file. Here's the complete entry of "Temporary files" :
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary
Files]
@="{C0E13E61-0CC6-11d1-BBB6-0060978B2AE6}"
"PropertyBag"="{60F6E465-4DEF-11d2-B2D9-00C04F8EEC8C}"
"FileList"="*.TMP|~*.*|CDMINSTALL"
"Folder"="C:\\WINDOWS\\TEMP\\"
"Flags"=dword:00000041
"LastAccess"=dword:00000007
"display"="Temporary files"
"description"="Programs sometimes store temporary information in a
TEMP folder. Before a program closes, it usually deletes this
information.

I took a look at another XP system and in the "Folder"
location, it has %TEMP%.

%TEMP% seems to point to %userprofile%\local settings\temp.
Not sure why there's a descrepancy.

I reviewed the C:\ folder to try and determine what was deleted.
As well as a couple of AVI file, some misc. files also, such as LOG
and a couple of TXT files. In fact the only files remaining there,
are files with the "system" attribute such as BOOT.INI..
All sub-level folders are intact.

Dave

 

[dave xnet]

Hello - by root I simply mean the highest level - C:\

Dave

New information. I recreated the problem by copying clock.avi into
c:\, running disk cleanup with the default items selected and the
avi file was gone.
I copied the avi again, and ran disk cleanup and deselected everything
except the temporary pchealth files. Once again the avi was deleted.
This is the culprit. What is this item?
My other XP doesn't have this. Is it because this problem
box was upgraded from windows ME while the other was a
fresh installl ? This is a strange problem.

This is how the entry looked:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary
PC Health files]
@="{C0E13E61-0CC6-11d1-BBB6-0060978B2AE6}"
"display"="Temporary PC Health files"
"description"="PC Health ensures that your system remains healthy at
all times. It sometimes makes copies of files being installed. This
option will delete the copies that are no longer required."
"flags"=dword:00000000
"filelist"="*.*"
"lastaccess"=dword:00000000
"StateFlags0000"=dword:00000002
"StateFlags"=dword:00000001
"StateFlags0099"=dword:00000000

For now I have delted this entire key from the registry. Disk
cleanup, for now, appears to be working.
Dave

 

[da_test]

I found this post from some other user apparently experiencing the same
thing !
http://groups.google.com/group/micr...ntain/msg/6ae2dc0f0a2353bd?dmode=source&hl=en

Dave

 

[Guest]

Nice bit of troubleshooting there Dave,

The file list *.* seems very suspicious, so I did some research.
http://24seven.aw.com/articles/article.asp?p=359169

Found that PCHEALTH is related to system restore , but there already is
another option to clean up restore points , do you have any third party
registry / disk cleaning tools ?
The value @="{C0E13E61-0CC6-11d1-BBB6-0060978B2AE6}" looks like it might
lead you to finding more related information.
C0E13E61-0CC6-11d1-BBB6-0060978B2AE6 looks like the product GUID , however I
wouldn't normally recommend splashing around the registry , but hey it's
worked so far .

 

[David Candy]

Type in Start Run
Regsvr32 dataclen

Does that registry key remain the same? I don't have a PC Health entry. But your entry is missing at leat 1 and/or two values. CSIDL= and/or Folder=. CSIDL is a numver representing well known folders (like My Docs, My Pics, & Send To). If both are present then folders are the sub folders of the CSIDL else it is the path. I think it finds C:\ as nothing is specified (simular to what I suspected when I thought you may have typed that path from regedit rather than export).

This is the Data Driven Cleaner (@="{C0E13E61-0CC6-11d1-BBB6-0060978B2AE6}" tells us that). You can make as many custom cleaners as you want. You program it with registry entries.

This instance, called PC Health files, is programed to delete *.* files that were accessed more than 0 days ago but not system, hidden, etc and don't do sub dirs. Also it only shows when there are files to be deleted and it won't remove the directory. Nor will it run without permission in a critical low disk space situation. Mostly because no flags have been set. It also has been scheduled twice (two numbered StateFlags).

 

[David Candy]

That is the system temp directory. But users override it. It is almost never used. From dim memory it does look like the ME entries. Perhaps the other one is also from ME as I have cleaners similar in purpose but different in name. See if other post fixes. If not delete whole key (Vol Caches) and run fix. It will respect some existing entries.

You don't want to delete first and run fix because that will delete any third party cleaners, if any, and the fix can't fix what it doesn't do.

--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================

HOW did you get that path you show. What did you do to find it.

I used regedit at the location specified. That path was hard coded
in the "Folder" item. I exported the item and that's how it looks in
REG file. Here's the complete entry of "Temporary files" :
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary
Files]
@="{C0E13E61-0CC6-11d1-BBB6-0060978B2AE6}"
"PropertyBag"="{60F6E465-4DEF-11d2-B2D9-00C04F8EEC8C}"
"FileList"="*.TMP|~*.*|CDMINSTALL"
"Folder"="C:\\WINDOWS\\TEMP\\"
"Flags"=dword:00000041
"LastAccess"=dword:00000007
"display"="Temporary files"
"description"="Programs sometimes store temporary information in a
TEMP folder. Before a program closes, it usually deletes this
information.

I took a look at another XP system and in the "Folder"
location, it has %TEMP%.

%TEMP% seems to point to %userprofile%\local settings\temp.
Not sure why there's a descrepancy.

I reviewed the C:\ folder to try and determine what was deleted.
As well as a couple of AVI file, some misc. files also, such as LOG
and a couple of TXT files. In fact the only files remaining there,
are files with the "system" attribute such as BOOT.INI..
All sub-level folders are intact.

Dave

 

[David Candy]

Actually

Regsvr32 /u dataclen will remove XP's settings. Then you can review the rest for third part or ME (delete MEs)and then run the fix.

--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================
"David Candy" <.> wrote in message That is the system temp directory. But users override it. It is almost never used. From dim memory it does look like the ME entries. Perhaps the other one is also from ME as I have cleaners similar in purpose but different in name. See if other post fixes. If not delete whole key (Vol Caches) and run fix. It will respect some existing entries.

You don't want to delete first and run fix because that will delete any third party cleaners, if any, and the fix can't fix what it doesn't do.

--
--------------------------------------------------------------------------------------------------
Goodbye Web Diary
http://margokingston.typepad.com/harry_version_2/2005/12/thank_you_and_g.html#comments
=================================================

HOW did you get that path you show. What did you do to find it.

I used regedit at the location specified. That path was hard coded
in the "Folder" item. I exported the item and that's how it looks in
REG file. Here's the complete entry of "Temporary files" :
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary
Files]
@="{C0E13E61-0CC6-11d1-BBB6-0060978B2AE6}"
"PropertyBag"="{60F6E465-4DEF-11d2-B2D9-00C04F8EEC8C}"
"FileList"="*.TMP|~*.*|CDMINSTALL"
"Folder"="C:\\WINDOWS\\TEMP\\"
"Flags"=dword:00000041
"LastAccess"=dword:00000007
"display"="Temporary files"
"description"="Programs sometimes store temporary information in a
TEMP folder. Before a program closes, it usually deletes this
information.

I took a look at another XP system and in the "Folder"
location, it has %TEMP%.

%TEMP% seems to point to %userprofile%\local settings\temp.
Not sure why there's a descrepancy.

I reviewed the C:\ folder to try and determine what was deleted.
As well as a couple of AVI file, some misc. files also, such as LOG
and a couple of TXT files. In fact the only files remaining there,
are files with the "system" attribute such as BOOT.INI..
All sub-level folders are intact.

Dave

 

[dave xnet]

Type in Start Run
Regsvr32 dataclen

Does that registry key remain the same? I don't have a PC Health entry. But your entry is missing at leat 1 and/or two values. CSIDL= and/or Folder=. CSIDL is a numver representing well known folders (like My Docs, My Pics, & Send To). If both are present then folders are the sub folders of the CSIDL else it is the path. I think it finds C:\ as nothing is specified (simular to what I suspected when I thought you may have typed that path from regedit rather than export).

This is the Data Driven Cleaner (@="{C0E13E61-0CC6-11d1-BBB6-0060978B2AE6}" tells us that). You can make as many custom cleaners as you want. You program it with registry entries.

This instance, called PC Health files, is programed to delete *.* files that were accessed more than 0 days ago but not system, hidden, etc and don't do sub dirs. Also it only shows when there are files to be deleted and it won't remove the directory. Nor will it run without permission in a critical low disk space situation. Mostly because no flags have been set. It also has been scheduled twice (two numbered StateFlags).

Hi David,
thanks for the info. I ended up deleting the whole volumecaches key,
then recreating it using regsvr32 dataclen. Seems OK, but they're
fewer entries now.

I might put it back the way it was, because, now that I kn9w what's
going on with the "pc health" key, I can use it to my advantage.

Can you please tell me where all those state flags are documented?

Thanks,
Dave

 

[dave xnet]

Nice bit of troubleshooting there Dave,

The file list *.* seems very suspicious, so I did some research.
http://24seven.aw.com/articles/article.asp?p=359169

Found that PCHEALTH is related to system restore , but there already is
another option to clean up restore points , do you have any third party
registry / disk cleaning tools ?
The value @="{C0E13E61-0CC6-11d1-BBB6-0060978B2AE6}" looks like it might
lead you to finding more related information.
C0E13E61-0CC6-11d1-BBB6-0060978B2AE6 looks like the product GUID , however I
wouldn't normally recommend splashing around the registry , but hey it's
worked so far .

Thanks for the pointer to the article. I'm ahead of the game now.
Looks like I can use that "pchealth" entry to create a customized
"clean" entry to delete, for example, *.tmp in folders of my choice.

I did lose some AVI and other files and as I mentioned in my post,
unable to retrieve them. So much for the undelete tools.
Dave

 

[David Candy]

ME probably added them with whatever the maintenance wizard was called in ME. The downgrade XP doesn't have this feature.StateFlags is whatever you tick or untick interactively. StateFlags0001 is run 1, etc.