Macrium Image Guardian service conceals deleted files


Author
Message
stephen_c
stephen_c
New Member
New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)
Group: Forum Members
Posts: 21, Visits: 122
With Macrium Image Guardian running, when I delete a backup image from within Reflect, I get a message to say that the file is being sent to the Recycle Bin.  However, when I open the Recycle Bin, the file is not visible.
If I disable the MIG, the file appears.
It seems that the only way I can view and delete the file from the Recycle Bin is to turn MIG off temporarily.
I run Windows 7 x64 with the latest Reflect build (2646).



Nick
Nick
Macrium Representative
Macrium Representative (2.5K reputation)Macrium Representative (2.5K reputation)Macrium Representative (2.5K reputation)Macrium Representative (2.5K reputation)Macrium Representative (2.5K reputation)Macrium Representative (2.5K reputation)Macrium Representative (2.5K reputation)Macrium Representative (2.5K reputation)Macrium Representative (2.5K reputation)
Group: Administrators
Posts: 1.4K, Visits: 7.6K
Hi 

Thanks for posting. 

That's strange, Reflect doesn't use the Recycle bin when deleting files. Files are first moved to a sub folder '_Macrium_Delete_' and deleted directly from there.

Can let us know the steps you have taken to delete the backup files? Are you running any other software that might override normal delete behaviour? 


Kind Regards

Nick - Macrium Support

Edited 15 October 2017 12:15 PM by Nick
stephen_c
stephen_c
New Member
New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)
Group: Forum Members
Posts: 21, Visits: 122
Hi Nick
My procedure for deleting these files is as follows:
1. Open Reflect, clicking the UAC prompt when it displays.
2.Go to the Restore tab, selecting 'Browse for an image or backup file to restore...'
3.Select the image I wish to delete, right-click on it and select 'Delete'.
4. If the image is too big for the Recycle Bin, it then deletes without any trouble.  However, when I have done an image of the 'partition(s) required to backup and restore Windows' the image gets sent to my Recycle Bin.
5. Open my Recycle Bin. If MIG is running I am unable to see the deleted file (although I know it's still there as it's over 80 GB of data).
6. Turn off MIG and the file appears, and I can then delete it.

I became aware of this problem with build 2619 but was more concerned at that point with not being able to stop the MIG service for an update. This problem has persisted through both subsequent Reflect builds.

I run AVG Internet Security and Malwarebytes Anti Exploit; I would not expect either of those to play any role in this.

jphughan
jphughan
Most Valuable Professional
Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)
Group: Forum Members
Posts: 2.8K, Visits: 19K
If you haven't already thought of this, just as a tip for conducting further testing on an issue of this nature, you may find it easier to create an image of only a smaller partition, e.g. EFI or Recovery, rather than everything required to boot Windows, since that will allow images to be created much more quickly and well under the size threshold for the Recycle Bin.

Doe AVG or Malwarebytes include any sort of functionality that prevents delete operations that bypass the Recycle Bin and instead redirects those files to the Recycle Bin, perhaps to allow the user an opportunity to retrieve them after a malicious application has attempted to delete them?  That wouldn't explain why the files aren't visible in the Recycle Bin until MIG is disabled, but the question is why they're ending up there to begin with, since I delete backups the way you describe and I've never had any of my backup files land there, even when they were tiny test backups.

Edited 15 October 2017 2:48 PM by jphughan
stephen_c
stephen_c
New Member
New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)
Group: Forum Members
Posts: 21, Visits: 122
I'm aware of the possibility of smaller backups for testing purposes.
Neither AVG Internet Security nor Malwarebytes Anti Exploit prevent direct deletion of files.
Using the SpaceSniffer utility, I am able to see that the deleted file is in fact in the Recycle Bin, even if it isn't visible when opening the bin.


stephen_c
stephen_c
New Member
New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)
Group: Forum Members
Posts: 21, Visits: 122
Here's what I see at the point I delete the file:
https://forum.macrium.com/uploads/images/8ede7784-fbbb-46db-a869-9514.jpg

"Are you sure you want to move this file to the Recycle Bin?"



Edited 15 October 2017 3:18 PM by stephen_c
jphughan
jphughan
Most Valuable Professional
Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)
Group: Forum Members
Posts: 2.8K, Visits: 19K
A picture is worth a thousand words....  That is not the intended way to delete a file.  With that mechanism, you're technically using the Windows UI to delete the file, and therefore the Windows rules where you have to use Shift+Delete to bypass the Recycle Bin apply.  However, I believe you've just stumbled on a very clever way to delete files using the Windows UI without tripping MIG since you're technically doing it within Reflect, albeit not the normal way.  When I read your earlier post, I had assumed (obviously incorrectly) that you were actually selecting the desired file in that browse dialog in order to display it in Reflect and then right-clicking it in Reflect to delete it -- as opposed to right-clicking it within the browse dialog.  Although testing it just now, I also notice that right-clicking a backup in Reflect does not do anything.

Anyhow, the expected way to delete files from within Reflect is to select the image file under the Restore tab and click Other Actions > Delete.  If your images aren't listed there, click the "Folders to search" link and add the folder containing your images to that list.  An added benefit of this function is that when you select a backup for deletion this way, Reflect will also select any child backups for deletion before prompting you to confirm the action, which serves two useful purposes.  First, you will see the impact of deleting your selected backup, giving you a chance to avoid unintentionally rendering children backups useless when you may have wanted to keep them, and second, if you really DO intend to purge the selected backup and all of its children, Reflect does that for you automatically, which saves you some time and ensures sure that unusable child backups don't sit there taking up space.  If you only ever capture Full backups, this doesn't come into play, however.

https://forum.macrium.com/uploads/images/ee419d25-ccda-45f5-9f0c-f6aa.png

Edited 15 October 2017 3:50 PM by jphughan
stephen_c
stephen_c
New Member
New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)New Member (36 reputation)
Group: Forum Members
Posts: 21, Visits: 122
Thanks for sorting that out for me.

RayG
RayG
Advanced Member
Advanced Member (466 reputation)Advanced Member (466 reputation)Advanced Member (466 reputation)Advanced Member (466 reputation)Advanced Member (466 reputation)Advanced Member (466 reputation)Advanced Member (466 reputation)Advanced Member (466 reputation)Advanced Member (466 reputation)
Group: Forum Members
Posts: 230, Visits: 1K
[quote]
jphughan - 15 October 2017 3:32 PM
A picture is worth a thousand words....  That is not the intended way to delete a file.  With that mechanism, you're technically using the Windows UI to delete the file, and therefore the Windows rules where you have to use Shift+Delete to bypass the Recycle Bin apply.  However, I believe you've just stumbled on a very clever way to delete files using the Windows UI without tripping MIG since you're technically doing it within Reflect, albeit not the normal way. 
Hi JP
I had mentioned this way before I think, see my post here on 28th Spetember: https://forum.macrium.com/Topic16800-2.aspx It's one up from the bottom on page2


Regards
RayG
Windows10 X64 V1709 B16299.334 MR v7.1.2917

jphughan
jphughan
Most Valuable Professional
Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)Most Valuable Professional (3.9K reputation)
Group: Forum Members
Posts: 2.8K, Visits: 19K
Totally forgot about that, but it looks like the focus of that thread shifted before that was fully discussed. Anyhow, perhaps Macrium can fix this for others who may be deleting backup files this way.
Edited 15 October 2017 4:21 PM by jphughan
GO

Merge Selected

Merge into selected topic...



Merge into merge target...



Merge into a specific topic ID...




Similar Topics

Reading This Topic

Login

Explore
Messages
Mentions
Search