How can file be permanently deleted but still recoverable

[Guest]

Hi
why do people say that they have deleted a file from their computer but if
someone has enough knowledge or certain forensic software they can still
retrieve this file that was supposably deleted. If they can retrieve it then
it is not deleted. and when the file is supposably deleted but still in your
computer is there a difference in the space that it takes in hidden areas of
your computer. I would imagine that they would be compressed or sometthing
else.

 

[Ken Blake]

In new office 2003 user

why do people say that they have deleted a file from their
computer
but if someone has enough knowledge or certain forensic
software they
can still retrieve this file that was supposably deleted. If
they can
retrieve it then it is not deleted. and when the file is
supposably
deleted but still in your computer is there a difference in the
space
that it takes in hidden areas of your computer. I would imagine
that
they would be compressed or sometthing else.

No there's no difference in the space that it takes, nothing is
hidden, and it has nothing to do with compression.
"Deleting" a file doesn't actually delete it; it just marks the
space as available to be used. There are third-party programs
that can sometimes recover deleted files. The problem is that the
space used by the file is likely to become overwritten very
quickly, and this makes the file unrecoverable.



So your chances of successfully recovering this file are decent
if you try recovering it immediately after deleting it, and
rapidly go downhill from there. If you've been using the computer
since then (for example to write this question and read this
answer), your chances are probably very poor by now.



But if the file is important enough, it's worth a try anyway.
Stop using the computer in question immediately, if you haven't
done so already. Download an undelete program (here's one:
http://www3.telus.net/mikebike/RESTORATION.html but there are
several others to choose from; do a Google search) on a friend's
computer and bring it to yours on a floppy to try.



If this fails, your only other recourse is to take the drive to a
professional file recovery company. This kind of service is very
expensive and may or may not work in your case.

 

[Rick \Nutcase\ Rogers]

Hi,

Deleting a file just removes the reference to it, and marks the space it
occupies as available. The file itself and the space it occupies remains "as
is" until something overwrites it. This is the basis of the many recovery
programs, as they identify these files and allow a user to "recover" them.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Guest]

Thank You for the quick and well explained answer, it was explained in a
manner that even a beginner like myself could understand, and not in some
computer jargon that only a specific group of people could understand. Once
again thank you.

 

[Ken Blake]

In new office 2003 user

Thank You for the quick and well explained answer, it was
explained
in a manner that even a beginner like myself could understand,
and
not in some computer jargon that only a specific group of
people
could understand. Once again thank you.

You're welcome. Glad to help.

 

[Guest]

Thanks for replying to my post
Can you elaborate what you mean by removes the reference to it. what do you
mean by reference. Is it true that when a file gets deleted a letter from the
filename gets removed and replaced with another character or something like
that.

 

[Guest]

Hi Ken Blake,
Its is true that when a file gets deleted that a letter from the file name
gets changed with another character or something like that? That is why we
can not find the file.
Thank You in advance

 

[Malke]

Thanks for replying to my post
Can you elaborate what you mean by removes the reference to it. what
do you mean by reference. Is it true that when a file gets deleted a
letter from the filename gets removed and replaced with another
character or something like that.

No. It will help if you think of the operating system setting a little
"flag" on files that says basically (simplistically) "this is a good
file, don't overwrite it with any other data". Then when you delete the
file, that "flag" gets removed and the system knows it is OK to write
to that previously reserved area on the hard drive. The data is still
there until it gets overwritten by something else. That's why when
someone needs to recover data, we tell them to immediately stop working
on the machine. This is to prevent any data from being written to that
area on the hard drive. Then, as you were told, there is specialized
data recovery software that can see the files where the "flag" was
removed and retrieve them - up to a point.

HTH,

Malke

 

[Guest]

In the ol' days of DOS, using the 8.3 naming convention (8 characters for the
filename, 3 characters for the filename extension to identify the type of
data stored in the file), deleting the file would result in the last
character of the filename being replaced.

If you knew the full filename, no problem. If you had deleted say, all of
the files used by an application, then changed your mind, you would have to
know or be able to figure out what the missing letter should have been.

I don't know if the process is still the same for long filenames under
Windows XP.

 

[Guest]

In the ol' days of DOS, using the 8.3 naming convention (8 characters for the
filename, 3 characters for the filename extension to identify the type of
data stored in the file), deleting the file would result in the last
character of the filename being replaced.

If you knew the full filename, no problem. If you had deleted say, all of
the files used by an application, then changed your mind, you would have to
know or be able to figure out what the missing letter should have been.

I don't know if the process is still the same for long filenames under
Windows XP.

 

[Ken Blake]

In new office 2003 user

Hi Ken Blake,
Its is true that when a file gets deleted that a letter from
the file
name gets changed with another character or something like
that? That
is why we can not find the file.
Thank You in advance

When the file is deleted, the operating system marks the space it
used to use as available. How it does that--exactly where the
marking is--I'm not sure. A number of years ago, I believe it did
that by overwriting one of the characters of its name, but I
don't know whether it still works the same way.

But it really doesn't matter. Whether that marking is by
overwriting a character or some other way, the effect is that you
no longer see the file in My Comupter, Windows Explorer, or from
a command line DIR command. So you don't really have to be
concerned with the mechanism.

 

[Jim]

Thanks for replying to my post
Can you elaborate what you mean by removes the reference to it. what do you
mean by reference. Is it true that when a file gets deleted a letter from the
filename gets removed and replaced with another character or something like
that.

The is a file on the HD which contains the list of files. Each entry of
this list shows the file name, where on the HD that the file starts, and
whether the file is valid or not. That is amoung many other things about
the file. When you delete a file, the valid marker is changed from valid to
deleted. Nothing else about the file gets changed. So, it is a simple task
to find files that are marked invalid and resurrect them. However, the OS
is free to reuse the space occupied by invalid files whenever it needs to
create a new file. Thus, a recovery may not be possible if there has been
very much file activity in the meantime.
Jim

 

[Jone Doe]

The is a file on the HD which contains the list of files. Each entry of
this list shows the file name, where on the HD that the file starts, and
whether the file is valid or not. That is amoung many other things about
the file. When you delete a file, the valid marker is changed from valid
to
deleted. Nothing else about the file gets changed. So, it is a simple
task
to find files that are marked invalid and resurrect them. However, the OS
is free to reuse the space occupied by invalid files whenever it needs to
create a new file. Thus, a recovery may not be possible if there has been
very much file activity in the meantime.
Jim

Doesn't defrag reclaim that wasted space and make the left over deleted
files go away?

 

[Guest]

Doesn't defrag reclaim that wasted space and make the left over deleted
files go away?

Not completely.

Defrag only condenses files into sequential sectors to keep the files from
being stored across a series of non-sequential sectors. The storage capacity
does not increase as a result of the defrag operation. Typically, this means
copying the files in a more organized manner into the first available sectors
of the HD, including sectors occupied by deleted data. Defrag pays attention
to the space occupied by deleted files only if that space will benefit the
defragmentation of data files.

If the deleted file was stored in sectors not accessed by the defrag
operation (defrag does not bother with all sectors on a HD), then that
deleted file will still be located on the HD, intact.