PrivaZer Discussion Thread

Discussion in 'privacy technology' started by The_PrivaZer_Team, Feb 15, 2013.

  1. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
    Thanks for your help. We are investigating.
     
  2. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
  3. Circuit

    Circuit Registered Member

    Joined:
    Oct 7, 2014
    Posts:
    893
    Location:
    Land o fruits and nuts, and more crime.
    4 Errors here.
    2019-12-14 06_33_37-PrivaZer.png
     
  4. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
    Thanks for this precious screenshot.
    Working on a fix
     
  5. Quantumbit

    Quantumbit Registered Member

    Joined:
    Dec 14, 2019
    Posts:
    5
    Location:
    England
    Firstly thank you Privazer team for Privazer!

    I am using win7 64bit including all updates

    C drive encrypted with Veracrypt

    2 x slave drive also encrypted with Veracrypt

    All portable versions of Privazer to date.

    I have noticed if I perform a clean with Privazer (including MFT and Index attributes whilst all drives are mounted) any long path names are renamed with a "~" tilde.

    Also any long path within the MFT or Index attributes does not seem to be cleaned by Privazer. When Privazer is running it appears that it is working however (after a full cleaning cycle) if the user closes and re-opens Privazer, runs again, the same items remain in the MFT or Index attributes.

    I find it hard to believe no one else has noticed this so I am suspecting it must be something to do with me or my system.

    Could someone else please confirm?

    Thank you.
     
  6. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
  7. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
  8. Circuit

    Circuit Registered Member

    Joined:
    Oct 7, 2014
    Posts:
    893
    Location:
    Land o fruits and nuts, and more crime.
    Look's OK. 2019-12-14 09_15_58-PrivaZer.png
     
  9. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
  10. Circuit

    Circuit Registered Member

    Joined:
    Oct 7, 2014
    Posts:
    893
    Location:
    Land o fruits and nuts, and more crime.
    Is it OK to use this test or wait for next release?
     
  11. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
    OK to use. I'm still releasing a v3.0.85 for today including only this fix.
     
  12. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
    v3.0.85 just released with the fix !
     
  13. Circuit

    Circuit Registered Member

    Joined:
    Oct 7, 2014
    Posts:
    893
    Location:
    Land o fruits and nuts, and more crime.
    Thank you. That was fast work!
     
  14. liba

    liba Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    289
  15. Quantumbit

    Quantumbit Registered Member

    Joined:
    Dec 14, 2019
    Posts:
    5
    Location:
    England
    I worked through and modified the problem paths when I first noticed this issue. If it happens again I will re-post.

    However while trying to find the original problem paths to send you I noticed another possible issue.

    If a path to an mp3 file for example is something like...

    F:\Music Files\Greatest Hits Vol. 2 (3 CD)\CD 3\track1.mp3

    ...after running a full clean with Privazer the path is renamed...

    F:\Music Files\Greatest Hits Vol. 2 (3 CD)\CD3~2\track1.mp3

    So it looks as if the problem could be brackets in the path name?

    Thanks for your help.
     
  16. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
    Hello @liba,

    To securely clean the $Logfile journal or the USN journal, all entries needs to be overwriten.
    That's why you get the same number of entries cleaned.


    @Quantumbit,
    can you send us a screenshot of the leftovers in PrivaZer ? It is hard for me to figure out what your issue exactly is.
     
  17. Quantumbit

    Quantumbit Registered Member

    Joined:
    Dec 14, 2019
    Posts:
    5
    Location:
    England
    Thanks for your help The_PrivaZer_Team

    After re-reading my post I realise I have not explained myself very well, I'm sorry. I have been trying to find good examples to show you but when I first discovered the problem I used another cleaning program to clear the MFT and Index attributes issue so I don't have many examples left.

    For now forget the MFT problem as I believe the following is a related issue and once resolved it may fix both.

    My system

    Win7x64 All updates
    1 x C drive and 2 x slaves
    Veracrypt encrypted C drive and both slaves
    I only use the portable version of Privazer and I don't know if the installed version has the same issue. The problem has so far existed in all portable versions to date.
    All drives mounted (veracrypt) before cleaning.

    My C drive is simply operating system only.

    Slave 1 is my data and slave 2 is my backup of slave 1. I have a backup program which reads slave 1 and makes a mirror of it onto slave 2.

    I noticed that if I cleaned either slave dive (on its own not both) then performed a backup, my backup program noticed many files had changed during the cleaning process. Obviously this should not happen during a clean.

    When I looked at the changes that the backup program found it seemed to me that some path names had been changed by Privazer. What I found was some characters in the file names had been changed and also included a tilde "~".

    Example.

    Before a drive clean with Privazer the following file was on both slave 1 (F) and slave 2 (G).

    (F:\Music Files\Greatest Hits Vol. 2 (3 CD)\CD 3\track1.mp3)

    I run a drive clean on slave 2 (G) ONLY, then look at the file again and notice it has been changed to...

    (G:\Music Files\Greatest Hits Vol. 2 (3 CD)\CD3~2\track1.mp3) Notice \CD 3\ has changed to \CD3~2\


    The files seem intact but as their path name had changed my backup program saw them as new and this is how I noticed the issue. Without looking at the changed files in the backup program I would not have known these files/paths were being renamed during a clean with Privazer.

    My concern is that no one else has noticed this problem so I cannot rule out that there is something wrong with my system unrelated to Privazer.

    Thanks again
     
  18. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
    PrivaZer does not replace spaces with ~ in the file path and does not rename existing file. So, I'm not sure that was caused by PrivaZer....
    Keep us posted on your findings. We will be pleased to help.
     
  19. Quantumbit

    Quantumbit Registered Member

    Joined:
    Dec 14, 2019
    Posts:
    5
    Location:
    England
    It happens to me every time I use PrivaZer.

    Perhaps I should have also mentioned the slave drives are 2TB and formatted NTFS.

    I have just re-run a backup and no changes were found, run a disk clean on slave 2 using PrivaZer, then re-run the backup program and the same files are renamed as above.

    I can accept this may not be a PrivaZer problem but do you have any idea what it could be as it only happens when using PrivaZer. I have used other cleaning programs without this happening.

    I wonder if other users of PrivaZer could please look for path names on their disks which have a "~" tilde in them?

    Thanks
     
  20. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
    Which backup software do you run?
     
  21. Quantumbit

    Quantumbit Registered Member

    Joined:
    Dec 14, 2019
    Posts:
    5
    Location:
    England
    I use syncbackpro but I don't think it is anything to do with the backup program as I can see the file name has been changed on the drive itself.

    Unless users manually look through the changes log in their backup software I doubt they will notice this happening.

    EDIT
    I don't think many users will notice this because if they run PrivaZer on their first slave drive then perform a backup the file will never change name again as it has been renamed on the first slave drive. So from then on each backup scan will see the renamed file on the source as the same on destination and so not highlight it ever again.

    I only discovered this was happening as I just happened to clean the second slave drive first and by pure luck ran a backup before cleaning the slave 1 drive.

    To help eliminate any other concerns the computer is not connected to the internet as it has confidential data on it. As it is never connected it does not have an anti-virus or any other file protection software in case you suspect anything else.
     
    Last edited: Dec 16, 2019
  22. Circuit

    Circuit Registered Member

    Joined:
    Oct 7, 2014
    Posts:
    893
    Location:
    Land o fruits and nuts, and more crime.
    Why?
     
  23. liba

    liba Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    289
    Beacuse interesting.
     
  24. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    796
    Location:
    France
    Hello guys,
    here are some more info.
    $logfile is 65536 kB by default for each drive, so the amount of entries in $logfile is the same whatever the amount of space you have on your storage.

    More to see here :
    http://forensicinsight.org/wp-content/uploads/2013/06/F-INSIGHT-NTFS-Log-TrackerEnglish.pdf

    Check it with :
    chkdsk /L C:

    (sorry the output is in french below, as I'm french...)

    upload_2019-12-17_9-4-53.png


    The pre-allocated size of the USN journal will vary depending on the amount of files on your drive.
    More info here :
    https://binaryguru.wordpress.com/2017/01/05/increasing-the-size-of-the-ntfs-change-journal/

    Here are a 2 samples of run lists of 2 different $UsnJrnl journals :

    1. a "small" journal :
    upload_2019-12-17_9-31-50.png


    2. a "big" $UsnJrnl :

    upload_2019-12-17_9-32-57.png






    ---------------------------------
    Here are the results of USN and $logfile cleanups :

    upload_2019-12-17_9-8-39.png

    upload_2019-12-17_9-7-18.png

    upload_2019-12-17_9-7-39.png


    Hope it helps...
     
  25. Circuit

    Circuit Registered Member

    Joined:
    Oct 7, 2014
    Posts:
    893
    Location:
    Land o fruits and nuts, and more crime.
    I wanted to know the answer also.
    Now I know, thanks PrivaZer Team!
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.