Where Win 10 keeps photos from camera?

EZ wrote:

Uzytkownik "VanguardLH" napisal w wiadomosci
...
You don't want to remove the photo because it is stuck as the desktop
or
lockscreen background. You said you simply don't want it to appear in
the history list of "Choose a photo".

No. I wrote in my first post that began the thread:
I want the photo to be removed from the system at all.
However getting rid of the photo is not the only reason for reinstalling
the system.

Thanks for the info about the book.

Regards,
EZ


To reinstall the OS and do a "Clean Install", you
boot the installer DVD or the installer USB stick.

You can make an installer USB stick with the MediaCreationTool
dispensed by the Microsoft Windows 10 download page. The
USB stick made that way, should support UEFI booting as
well as legacy BIOS booting.

With the OS installer disc booted, instead of installing,
find the Troubleshooting button, and locate the Command Prompt
button. In Command Prompt, you will be running as a member
of the administrator group, so commands have the necessary
elevation.

Now, use the "diskpart" command.

diskpart

list disk

select disk 2

list partition === good if you want to verify which partitions are
about to be deleted.

clean all === this will erase the *entire* disk 2, every byte
will be zeroed. This could easily take hours to do!

clean === this only erases the MBR and partition table,
giving the "appearance" of clean. But TestDisk
could recover the disk if you do this. This
takes about a microsecond to complete.

exit

The "clean all" option makes the disc forensically clean, and
could take two to six hours depending on drive vintage and
drive size.

A "Clean OS" install can be done on a dirty disk. The extra
step above, of zeroing the disk drive from end to end, means
you're doing a "CLean OS" install on a "spotlessly clean"
disk drive. If the install is left at defaults, the C: partition
will take up most of the drive. And later, in Disk Management,
you can issue a "shrink" command to make C: take less space.

If you use the Custom interface in the installer DVD, then
you can control the size of any new partitions, and maybe
make C: a 50GB partition for example. Rather than allow
the installer to make a giant C: partition.

If the drive is larger than 2TB, you'll likely want GPT
partitioning and a UEFI boot. To do a UEFI boot with a
MediaCreationTool USB stick, use the "popup boot" key
on your computer. On my Asus, F8 is popup boot, while
del enters the BIOS. Other computers use different
keys for popup boot, such as F2 or F12 maybe. If you
removed the manufacturer splash screen via BIOS setting,
usually at the bottom of the first screen, you can see
a legend indicating what key to use for popup boot.
On an Insyde BIOS, the "timing window" for pressing F2
is only "one second* wide. And you have to be a
Ninja to time that accurately.

When the blue-bordered popup boot menu appears,
you'll see two entries for hybrid media...

Sandisk 32GB === This does a legacy install (2TB max drive)
UEFI: Sandisk 32GB === Boot Win10 installer this way,
to get a UEFI/GPT installation (2TB drive)

*******

AFAIK, OneDrive needs a Microsoft Account (MSA) for authentication
purposes. It wouldn't make much sense to be hoovering up data,
unless there was an identity associated with it. None of my
regular OSes use an MSA, so I don't have to worry about OneDrive.
Only my Win10 Insider has an MSA.

Paul

On 6/13/2019 6:47 PM, VanguardLH wrote:
EZ wrote:

Uzytkownik "VanguardLH" napisal w wiadomosci
...
You don't want to remove the photo because it is stuck as the desktop
or
lockscreen background. You said you simply don't want it to appear in
the history list of "Choose a photo".

No. I wrote in my first post that began the thread:
I want the photo to be removed from the system at all.

And did the unwanted photo disappear after adding more photo(s) to roll
out the old one or clearing the history cache folder?

The photo showing in the history list does not affect the use of the
computer or the OS, so an OS reinstall just to get rid of a photo that
has no effect on the setup is extreme. Doesn't appear you have tried to
clear the history (by rolling out the old photo or deleting from the
history cache).

Doesn't a system reinstall keep all user data? If so the photo will
still be there.

Returning to a backup from before the photo would be a better approach.

--
Zaidy036

Zaidy036 wrote:

On 6/13/2019 6:47 PM, VanguardLH wrote:
EZ wrote:

Uzytkownik "VanguardLH" napisal w wiadomosci
...
You don't want to remove the photo because it is stuck as the desktop
or
lockscreen background. You said you simply don't want it to appear in
the history list of "Choose a photo".

No. I wrote in my first post that began the thread:
I want the photo to be removed from the system at all.

And did the unwanted photo disappear after adding more photo(s) to roll
out the old one or clearing the history cache folder?

The photo showing in the history list does not affect the use of the
computer or the OS, so an OS reinstall just to get rid of a photo that
has no effect on the setup is extreme. Doesn't appear you have tried to
clear the history (by rolling out the old photo or deleting from the
history cache).

Doesn't a system reinstall keep all user data? If so the photo will
still be there.

https://www.onmsft.com/how-to/window...er-performance

What gets erased is your choice.

Returning to a backup from before the photo would be a better approach.

The OP appears oriented towards a fresh install of Windows 10 for other
but unidentified reasons. Wiping the install just because one photo is
still shown in a MRU (Most Recently Used) history list is way too
extreme just to get rid of an image file that isn't even being used nor
wanted.

Uzytkownik "Paul" napisal w wiadomosci
...
To reinstall the OS and do a "Clean Install", you
boot the installer DVD or the installer USB stick.
[...]
Thank you very much for such a detailed instruction.

AFAIK, OneDrive needs a Microsoft Account (MSA) for authentication
purposes.
That is also important to me.

As I wrote in my first post I want to find the picture and remove it
from the laptop.
I also want to discover and remember where such files are kept, in case
the
situation repeat. Better not.

I took another photo using the laptop camera.
The photo appeared in the folder: This PC Picture From camera.
(I sppose that in the English version of Win 10 the subfolder "From
camera"
is called "Camera Roll").
The name of the photo is: WIN_20190614_10_17_15_Pro.jpg

The new picture did not appeare in any subfolders of Windows Web.

Nothing changed in %AppData%\Microsoft\Windows\Themes\ and its
subfolder CachedFiles. Even dates did not change.

The new photo does not appeare in Lock Screen Background Picture.
The old photo is still there.

I used the FileSearchy program. The only place it shown for the new
picture
is C:\Users\my-name\Pictures\Camera Roll

Uzytkownik "Paul" napisal w wiadomosci
...
To reinstall the OS and do a "Clean Install", you
boot the installer DVD or the installer USB stick.
[...]
Thank you very much for such a detailed instruction.

AFAIK, OneDrive needs a Microsoft Account (MSA) for authentication
purposes.
That is also important to me.

As I wrote in my first post I want to find the picture and remove it
from the laptop.
I also want to discover and remember where such files are kept, in case
the
situation repeat. Better not.

I took another photo using the laptop camera.
The photo appeared in the folder: This PC Picture From camera.
(I sppose that in the English version of Win 10 the subfolder "From
camera"
is called "Camera Roll").
The name of the photo is: WIN_20190614_10_17_15_Pro.jpg

The new picture did not appeare in any subfolders of Windows Web.

Nothing changed in %AppData%\Microsoft\Windows\Themes\ and its
subfolder CachedFiles. Even dates did not change.

The new photo does not appeare in Lock Screen Background Picture.
The old photo is still there.

I used the FileSearchy program. The only place it shown for the new
picture
is C:\Users\my-name\Pictures\Camera Roll

Sorry for false start.

I tried to find in the FileSearch file: WIN_201905*.jpg but it found
nothing.

Is the place of the old picture kept in secret by Microsoft?

Regards,
EZ

On 14/06/2019 11.00, EZ wrote:

....

As I wrote in my first post I want to find the picture and remove it
from the laptop.
I also want to discover and remember where such files are kept, in case the
situation repeat. Better not.

I took another photo using the laptop camera.

What app took the photo? Search the menus of that app to see if it has
something to put that photo as wallpaper automatically and disable it.

The photo appeared in the folder: This PC Picture From camera.
(I sppose that in the English version of Win 10 the subfolder "From camera"
is called "Camera Roll").
The name of the photo is: WIN_20190614_10_17_15_Pro.jpg

The new picture did not appeare in any subfolders of Windows Web.

Nothing changed inÂ* %AppData%\Microsoft\Windows\Themes\ and its
subfolder CachedFiles. Even dates did not change.

The new photo does not appeare in Lock Screen Background Picture.
The old photo is still there.

I used the FileSearchy program. The only place it shown for the new picture
is C:\Users\my-name\Pictures\Camera Roll

Maybe the photo is not "stored", but just the current location. If you
delete the picture, and put another for the background, maybe it
remembers the old photo but can not display it.

Or, maybe it is stored in some form of "database" for wallpaper display
(can be just a directory of photos). Maybe searching for all files that
may contain photos would find it - for this you may need to ignore the
extension and test the real type of the file instead. Sorry, I know how
to do this in Linux, not in Windows. Maybe a forensics software.


--
Cheers, Carlos.

Uzytkownik "EZ" napisal w wiadomosci
...

Uzytkownik "Paul" napisal w wiadomosci
...
To reinstall the OS and do a "Clean Install", you
boot the installer DVD or the installer USB stick.
[...]
Thank you very much for such a detailed instruction.

AFAIK, OneDrive needs a Microsoft Account (MSA) for authentication
purposes.
That is also important to me.

As I wrote in my first post I want to find the picture and remove it
from the laptop.
I also want to discover and remember where such files are kept, in
case
the
situation repeat. Better not.

I took another photo using the laptop camera.
The photo appeared in the folder: This PC Picture From camera.
(I sppose that in the English version of Win 10 the subfolder "From
camera"
is called "Camera Roll").
The name of the photo is: WIN_20190614_10_17_15_Pro.jpg

The new picture did not appeare in any subfolders of Windows Web.

Nothing changed in %AppData%\Microsoft\Windows\Themes\ and its
subfolder CachedFiles. Even dates did not change.

The new photo does not appeare in Lock Screen Background Picture.
The old photo is still there.

I used the FileSearchy program. The only place it shown for the new
picture
is C:\Users\my-name\Pictures\Camera Roll

Sorry for false start.

I tried to find in the FileSearch file: WIN_201905*.jpg but it found
nothing.

Is the place of the old picture kept in secret by Microsoft?

The shareware program DiskDigger did not find any WIN*.jpg files either.

Now I will try the method described in:
https://www.askvg.com/windows-10-tip...y-in-settings/
gave by VanguardLH. Thanks.

Regards,
EZ

Uzytkownik "EZ" napisal w wiadomosci
.. .
Now I will try the method described in:
https://www.askvg.com/windows-10-tip...y-in-settings/
gave by VanguardLH. Thanks.

Using the above method and additionally:
https://www.askvg.com/guide-how-to-t...ly-in-windows/
I found the old picture in the folder:
This PC Windows ProgramData Microsoft Windows SystemData
S-1-5-21-....... readOnly LockScreen_A
Another subfolder is called LockScreen_W. It contains another one of the
5 pictures from the list on Lock screen Background Picture.

In fact my picture occurs in the folder LockScreen_A even 5 times with
names:
LockScreen.jpg, LockScreen__0108_0108.jpg, LockScreen__0151_0151.jpg,
LockScreen_0194_0194.jpg, LockScreen_1920_1080_notdimmed.jpg.
There are no other files in the directory.

So it is not the name WIN*.jpg like in This PC Pictures Camera Roll.

Before removing the files I tried to find them in the system using the
names LockScreen*.jpg. The FileSearchy program found all of the 5 files.
(If I knew the correct name starting from LockScreen, I could find the
picture(s) a few days ago).

Thanks once again for help from all of you.

Regards,
EZ

EZ wrote:

Uzytkownik "EZ" napisal w wiadomosci
.. .
Now I will try the method described in:
https://www.askvg.com/windows-10-tip...y-in-settings/

gave by VanguardLH. Thanks.

Using the above method and additionally:
https://www.askvg.com/guide-how-to-t...ly-in-windows/

I found the old picture in the folder:
This PC Windows ProgramData Microsoft Windows SystemData
S-1-5-21-....... readOnly LockScreen_A
Another subfolder is called LockScreen_W. It contains another one of the
5 pictures from the list on Lock screen Background Picture.

In fact my picture occurs in the folder LockScreen_A even 5 times with
names:
LockScreen.jpg, LockScreen__0108_0108.jpg, LockScreen__0151_0151.jpg,
LockScreen_0194_0194.jpg, LockScreen_1920_1080_notdimmed.jpg.
There are no other files in the directory.

So it is not the name WIN*.jpg like in This PC Pictures Camera Roll.

Before removing the files I tried to find them in the system using the
names LockScreen*.jpg. The FileSearchy program found all of the 5 files.
(If I knew the correct name starting from LockScreen, I could find the
picture(s) a few days ago).

Thanks once again for help from all of you.

Regards,
EZ


My method only covered 2/3rds of C: approximately, because
of permissions issues. It's a good thing you had that
article! I would have missed those.

The problem is, Win10 C: is too "damaged" for pure access
from Linux, and the permissions are all screwy on the
Windows 10 side. That makes it harder to do a good job
on projects like this.

One way to make the OS more accessible, is to make a
backup, convert it to a VHD, and in Disk Management,
mount the VHD. There's an option somewhere in that
sequence to "smash permissions" which makes some operations
easier to set up. Once the machine is free, I might try
another run to see if those files show up.

Paul

Uzytkownik "Paul" napisal w wiadomosci
...
(If I knew the correct name starting from LockScreen, I could find
the
picture(s) a few days ago).
Probably I was not right. I think I would not be able to find the files
before changing the permissions and I would not know which
permissions should be changed. So the procedure described in the
article was neccessary.
VanguardLH, many thanks once again.

It's a good thing you had that
article! I would have missed those.
The link to the second article was in the first article. :-)

Before removing the 5 files I had to eat my lunch so the display
switched off. After that I had to log in (as usual). I noticed that my
photo was not on the list of 5 pictures in Lock Screen Background
Picture as it was earlier, although the files were not removed
from the LockScreen_A folder yet. In its place the picture with colored
umbrellas was displayed.

After removing the files with my photo from LockScreen_A folder,
only 4 pictures are displayed on Lock Screen Background Picture.
The picture with umbrellas disappeared.

I removed the new (today) photo from This PC Pictures Camera Roll.
The picture did not appear in the list of pictures on Lock Screen
Background Picture. The folder LockScreen_A is empty.

Regards,
EZ

EZ wrote:

I took another photo using the laptop camera. The photo appeared in
the folder: This PC Picture From camera. (I sppose that in the
English version of Win 10 the subfolder "From camera" is called
"Camera Roll"). The name of the photo is:
WIN_20190614_10_17_15_Pro.jpg

The new picture did not appeare in any subfolders of Windows Web.

Nothing changed in %AppData%\Microsoft\Windows\Themes\ and its
subfolder CachedFiles. Even dates did not change.

The new photo does not appeare in Lock Screen Background Picture.
The old photo is still there.

I used the FileSearchy program. The only place it shown for the new
picture is C:\Users\my-name\Pictures\Camera Roll

Taking a photo and saving its image file to the drive does not
automatically make it the background for the desktop or lockscreen.
You'll have to go into the lockscreen "Choose a picture" settings and
actually select that image file.

Uzytkownik "VanguardLH" napisal w wiadomosci
news
Taking a photo and saving its image file to the drive does not
automatically make it the background for the desktop or lockscreen.
You'll have to go into the lockscreen "Choose a picture" settings and
actually select that image file.
I do not remember that I did anything like that with the first photo
I was looking for. That is why I was surprised that the photo appeared
in lockscreen.
Fortunately now I know where such photo is kept and in similar case
I would be able to remove it. At least I hope so.

Regards,
EZ

EZ wrote:

VanguardLH ...

Taking a photo and saving its image file to the drive does not
automatically make it the background for the desktop or lockscreen.
You'll have to go into the lockscreen "Choose a picture" settings
and actually select that image file.

I do not remember that I did anything like that with the first photo
I was looking for. That is why I was surprised that the photo
appeared in lockscreen. Fortunately now I know where such photo is
kept and in similar case I would be able to remove it. At least I
hope so.

What works now may not later. Windows 10 is betaware and will remain
so. Do not think the "10" is the version. Think of it as instead part
of the product's name, like "Windows10", "Win10", "WinX", or "WX".
Despite what Microsoft claims, "10" is not the last version of Windows.
New versions show up about every 6 months. Each time they can add, take
away, and modify.

In the past, the Win32 API was used to code the programs. UWP
(Universal Windows Platform - and that name has changed several times
before settling on UWP) app use a different runtime library set, called
Windows RT (aka WinRT), for their coding. By the time all the legacy
programs have rewritten their code from Win32 to WinRT (I don't know of
a porting scheme), like after 6 to 8 years, WinRT will be dead and
Microsoft will promote some new programming paradigm.

Microsoft has been playing with Linux for some time, but it's getting
accelerated with Azure, Linux in Windows 10, etc. I suspect in about
the 6-8 year time frame that Microsoft may incorporate their HyperVisor
to run both Linux and Windows (with the latter for backwards
compatibility ... for awhile) in a transparent mode that melds the two
OSes into a single desktop. Then eventually the Windows kernel will get
supported, like after another 4 years, and Microsoft would've finally
migrated to a Linux kernel.

EZ wrote:

Uzytkownik "Paul" napisal w wiadomosci
...
(If I knew the correct name starting from LockScreen, I could find the
picture(s) a few days ago).
Probably I was not right. I think I would not be able to find the files
before changing the permissions and I would not know which
permissions should be changed. So the procedure described in the
article was neccessary.
VanguardLH, many thanks once again.

It's a good thing you had that
article! I would have missed those.
The link to the second article was in the first article. :-)

Before removing the 5 files I had to eat my lunch so the display
switched off. After that I had to log in (as usual). I noticed that my
photo was not on the list of 5 pictures in Lock Screen Background
Picture as it was earlier, although the files were not removed
from the LockScreen_A folder yet. In its place the picture with colored
umbrellas was displayed.

After removing the files with my photo from LockScreen_A folder,
only 4 pictures are displayed on Lock Screen Background Picture.
The picture with umbrellas disappeared.

I removed the new (today) photo from This PC Pictures Camera Roll.
The picture did not appear in the list of pictures on Lock Screen
Background Picture. The folder LockScreen_A is empty.

Regards,
EZ

Just getting a file count is difficult.

# AgentRansack will not export .metadata (files with leading dot)

307531 Agent Ransack

# nfi.exe (~ year 2000) won't list hardlinks (System32 poorly represented)

287415 NFI no hardlinks!
287190 (no meta)
285841 (no dup)

# Everything.exe missed the files in lxss\temp
# Everything missed LockScreen.jpg in the "article folder".

Everything -create-filelist every_c.txt "C:"

314494 Everything files+dirs
337702 Everything files+dirs

# Win10 Bash shell "find" command for -d dir and for files

320000 268039+51961 find in bash

229758 C: files only find files on C: (permissions denied)

268106 I: files only find files on Macrium mount on I:
where "permissions have been turned off".

Note that the scan of I: *still* missed the "article folder"

C:\ProgramData\Microsoft\Windows\SystemData\User_A ccount_Security_Identifier\ReadOnly

So really, toolwise, I wouldn't have found the three lockscreen folders in
that path, with any of the tools I have now. The images in the following
folders could not be found.

https://i.postimg.cc/gJ8Zm8yC/image-fun-at-MSFT.gif

The findimagedups found these. The five images at the top of the 'MSFT.gif
would add to this set. Picture111.jpg is the original webcam picture I
took, to kick off some fiddling with lockscreens and backgrounds. A tile
even popped up for Windows.Photos with the guilty image promoted in it!
You're quite right, that no matter how careful you are today, that
image could be "sprayed six ways from Sunday".

C:/Users/username/.thumbnails/normal/ca4fd7e365e580ca169ec53ada0263d7.png
C:/Users/username/AppData/Roaming/Microsoft/Windows/Themes/CachedFiles/CachedImage_1440_900_POS4.jpg
C:/Users/username/.thumbnails/normal/39c5e9bcd05647a385905a3e04e3e994.png
C:/Users/username/.thumbnails/normal/e85284c912fc42a7f897036148190a97.png
C:/Users/username/.thumbnails/normal/d6761d3f19b5382d0e53002869524dd4.png
C:/Users/username/.thumbnails/normal/29cc4b027f74d858584f39b605960ee0.png
C:/Users/username/AppData/Local/Packages/Microsoft.Windows.Photos_8wekyb3d8bbwe/LocalState/PhotosAppTile/Tile0.jpg
C:/Users/username/Pictures/Logitech Webcam/Picture111.jpg
C:/Users/username/AppData/Roaming/Microsoft/Windows/Themes/TranscodedWallpaper

It's possible the five thumbnails, are ones made from the top five
"LockScreen*" images in the 'MSFT.gif example.

I no longer dream of working in the forensic industry - not
since Windows 10 came out at least.

To mount C: in Linux, I used "ntfsfix" on Mint, to correct the
damaged $MFTMIRR Microsoft likes to leave behind. That is, in fact,
how I gained access to these, and took some pictures.

# Linux, ntfsfix before double-click mount

C:\ProgramData\Microsoft\Windows\SystemData\User_A ccount_Security_Identifier\ReadOnly

And that, of course, ignores the copies you could recover with
Photorec, while the system had been editing stuff... This wasn't
a low-level forensic exercise, just a sweep of "files that
currently exist".

Nuke and pave is less work than this!

Paul