This article provides an overview of SafeClean and a list of frequently asked questions.
Applies to the following Sophos product(s) and version(s) Sophos Virus Removal Tool
SafeClean offers recovery of recent files that have been cleaned up.
If SafeClean functionality is available in the product that is performing clean up of malicious files, a copy of the file will first be encrypted and backed up on the local computer (to the 'bin', see below). The original file will then be cleaned up in the normal way but the copy can be recovered if necessary.
SafeClean is currently only available in the free Sophos Virus Removal Tool (SVRT) but will eventually be incorporated in all Sophos Anti-Virus products.
The bin is a term used to describe the storage area of the encrypted copies of files captured by SafeClean.
C:\Documents and Settings\All Users\Application Data\Sophos\SafeClean\
100MB. You cannot increase this size.
50MB. You cannot increase this size.
After the addition of a file that causes the bin size to exceed 100MB an auto-purge is run. The purge reduces the bin size to 50MB by removing the oldest file first and working forward based on the timestamp of when the file was added to the bin.
No. SafeClean only takes copies of files marked for cleanup having run a scan. This copy should not be considered a backup as the bin will be auto-purged as necessary (see above) to make room for newer files.
If the checksum of two files match (i.e., the files are exactly alike) only a record of the duplicate file is saved (the file name and folder path). This prevents duplicate files from filling up the bin.
You will need to use 'scc.exe' which is a command line utility. Instructions on obtaining this utility and how to use it are available in article 119981.
If a request is made to restore a file which already exists (regardless of checksum) then an error will occur and the restore will not take place. You will need to move the existing file from its current folder to allow the restore from the bin to succeed.
From a command prompt run scc.exe -h for a full list of available options.
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.