PrivaZer Discussion Thread

Thanks for your help. We are investigating.

 

@liba, @Circuit,

please download this modified version :
https://www.privazer.com/PrivaZer_free-liba-circuit.exe

It will show up more info on the error.
Send us a new screenshot.

 

4 Errors here.

 

Thanks for this precious screenshot.
Working on a fix

 

Firstly thank you Privazer team for Privazer!

I am using win7 64bit including all updates

C drive encrypted with Veracrypt

2 x slave drive also encrypted with Veracrypt

All portable versions of Privazer to date.

I have noticed if I perform a clean with Privazer (including MFT and Index attributes whilst all drives are mounted) any long path names are renamed with a "~" tilde.

Also any long path within the MFT or Index attributes does not seem to be cleaned by Privazer. When Privazer is running it appears that it is working however (after a full cleaning cycle) if the user closes and re-opens Privazer, runs again, the same items remain in the MFT or Index attributes.

I find it hard to believe no one else has noticed this so I am suspecting it must be something to do with me or my system.

Could someone else please confirm?

Thank you.

 

@liba, @Circuit,

please test this fix :
https://www.privazer.com/PrivaZer_free-liba-circuit-v2.exe

 

Hello @Quantumbit,

could you send us a screenshot of the leftovers (with "~") in the MFT found by PrivaZer, either here or to support@privazer.com ?

 

Look's OK.

 

Great !

 

Is it OK to use this test or wait for next release?

 

OK to use. I'm still releasing a v3.0.85 for today including only this fix.

 

v3.0.85 just released with the fix !

 

Thank you. That was fast work!

 

Problem solved for me. Thank you Team.
https://img.techpowerup.org/191214/untitled106.jpg

And I wondered. Why everyone is the same number?

219929 $LogFile entries cleaned
80660 USN entries cleaned

 

I worked through and modified the problem paths when I first noticed this issue. If it happens again I will re-post.

However while trying to find the original problem paths to send you I noticed another possible issue.

If a path to an mp3 file for example is something like...

F:\Music Files\Greatest Hits Vol. 2 (3 CD)\CD 3\track1.mp3

...after running a full clean with Privazer the path is renamed...

F:\Music Files\Greatest Hits Vol. 2 (3 CD)\CD3~2\track1.mp3

So it looks as if the problem could be brackets in the path name?

Thanks for your help.

 

Hello @liba,

To securely clean the $Logfile journal or the USN journal, all entries needs to be overwriten.
That's why you get the same number of entries cleaned.


@Quantumbit,
can you send us a screenshot of the leftovers in PrivaZer ? It is hard for me to figure out what your issue exactly is.

 

Thanks for your help The_PrivaZer_Team

After re-reading my post I realise I have not explained myself very well, I'm sorry. I have been trying to find good examples to show you but when I first discovered the problem I used another cleaning program to clear the MFT and Index attributes issue so I don't have many examples left.

For now forget the MFT problem as I believe the following is a related issue and once resolved it may fix both.

My system

Win7x64 All updates
1 x C drive and 2 x slaves
Veracrypt encrypted C drive and both slaves
I only use the portable version of Privazer and I don't know if the installed version has the same issue. The problem has so far existed in all portable versions to date.
All drives mounted (veracrypt) before cleaning.

My C drive is simply operating system only.

Slave 1 is my data and slave 2 is my backup of slave 1. I have a backup program which reads slave 1 and makes a mirror of it onto slave 2.

I noticed that if I cleaned either slave dive (on its own not both) then performed a backup, my backup program noticed many files had changed during the cleaning process. Obviously this should not happen during a clean.

When I looked at the changes that the backup program found it seemed to me that some path names had been changed by Privazer. What I found was some characters in the file names had been changed and also included a tilde "~".

Example.

Before a drive clean with Privazer the following file was on both slave 1 (F) and slave 2 (G).

(F:\Music Files\Greatest Hits Vol. 2 (3 CD)\CD 3\track1.mp3)

I run a drive clean on slave 2 (G) ONLY, then look at the file again and notice it has been changed to...

(G:\Music Files\Greatest Hits Vol. 2 (3 CD)\CD3~2\track1.mp3) Notice \CD 3\ has changed to \CD3~2\


The files seem intact but as their path name had changed my backup program saw them as new and this is how I noticed the issue. Without looking at the changed files in the backup program I would not have known these files/paths were being renamed during a clean with Privazer.

My concern is that no one else has noticed this problem so I cannot rule out that there is something wrong with my system unrelated to Privazer.

Thanks again

 

PrivaZer does not replace spaces with ~ in the file path and does not rename existing file. So, I'm not sure that was caused by PrivaZer....
Keep us posted on your findings. We will be pleased to help.

 

It happens to me every time I use PrivaZer.

Perhaps I should have also mentioned the slave drives are 2TB and formatted NTFS.

I have just re-run a backup and no changes were found, run a disk clean on slave 2 using PrivaZer, then re-run the backup program and the same files are renamed as above.

I can accept this may not be a PrivaZer problem but do you have any idea what it could be as it only happens when using PrivaZer. I have used other cleaning programs without this happening.

I wonder if other users of PrivaZer could please look for path names on their disks which have a "~" tilde in them?

Thanks

 

Which backup software do you run?

 

I use syncbackpro but I don't think it is anything to do with the backup program as I can see the file name has been changed on the drive itself.

Unless users manually look through the changes log in their backup software I doubt they will notice this happening.

EDIT
I don't think many users will notice this because if they run PrivaZer on their first slave drive then perform a backup the file will never change name again as it has been renamed on the first slave drive. So from then on each backup scan will see the renamed file on the source as the same on destination and so not highlight it ever again.

I only discovered this was happening as I just happened to clean the second slave drive first and by pure luck ran a backup before cleaning the slave 1 drive.

To help eliminate any other concerns the computer is not connected to the internet as it has confidential data on it. As it is never connected it does not have an anti-virus or any other file protection software in case you suspect anything else.

 

Why?

 

Beacuse interesting.

 

Hello guys,
here are some more info.
$logfile is 65536 kB by default for each drive, so the amount of entries in $logfile is the same whatever the amount of space you have on your storage.

More to see here :
http://forensicinsight.org/wp-content/uploads/2013/06/F-INSIGHT-NTFS-Log-TrackerEnglish.pdf

Check it with :
chkdsk /L C:

(sorry the output is in french below, as I'm french...)




The pre-allocated size of the USN journal will vary depending on the amount of files on your drive.
More info here :
https://binaryguru.wordpress.com/2017/01/05/increasing-the-size-of-the-ntfs-change-journal/

Here are a 2 samples of run lists of 2 different $UsnJrnl journals :

1. a "small" journal :



2. a "big" $UsnJrnl :








---------------------------------
Here are the results of USN and $logfile cleanups :








Hope it helps...

 

I wanted to know the answer also.
Now I know, thanks PrivaZer Team!