What does delete really do?

  • Thread starter Thread starter Dave
  • Start date Start date
D

Dave

Not sure I'm on the right list, but ---

Let's say I have a rather large Win XP document, no longer needed, so I just
'delete' it. It goes into my Recycle Bin, but let's also then empty it as
well.

As I understand it, the document is still on my HD someplace (maybe more
than one place?), however, by 'deleting' it all that really happened was
some of the first index bytes of the appropriate cylinder/track/sector were
changed to indicate that particular c/t/s was now available for overwriting.
As long as no new material is saved to the HD which overwrites this c/t/s,
then, the document is still recoverable by undelete and/or related
techniques.

Now to my question. Let's say I delete the document by deleting the entire
contents of the document (while it's still open), then close the now-empty
document, saving it under the same name. The question is, is the entire
(original) document still recoverable? By any technique?

TIA
Dave
 
yes,

keep in mind
that one file may actually
be in fragments through
out your disk.

the larger the file the
more fragments exist.

so if your 20 megabyte
file was then saved
into a 1k file because
you remove all the
data, the other fragments
are still lingering.

further, if the software
has a feature that backups
files in the background,
then they too linger and
are overlooked and are
not deleted.

what is helpful is to
simply "scrub" the drive
on occasion.
 
Now to my question. Let's say I delete the document by deleting the
entire contents of the document (while it's still open), then close
the now-empty document, saving it under the same name. The question
is, is the entire (original) document still recoverable? By any
technique?
Click to expand...

To remove deleted documents and information you can use a freeware
called sdelete (secure delete) fro http://sysinternals.com
 
Dave said:
Not sure I'm on the right list, but ---

Let's say I have a rather large Win XP document, no longer needed, so I
just 'delete' it. It goes into my Recycle Bin, but let's also then empty
it as well.

As I understand it, the document is still on my HD someplace (maybe more
than one place?), however, by 'deleting' it all that really happened was
some of the first index bytes of the appropriate cylinder/track/sector
were changed to indicate that particular c/t/s was now available for
overwriting. As long as no new material is saved to the HD which
overwrites this c/t/s, then, the document is still recoverable by undelete
and/or related techniques.

Now to my question. Let's say I delete the document by deleting the
entire contents of the document (while it's still open), then close the
now-empty document, saving it under the same name. The question is, is
the entire (original) document still recoverable? By any technique?

TIA
Dave
Click to expand...


That would depend on whether the OS saves the new file by overwriting any
sectors the original file occupied, or if it just saved the file elsewhere
and marked the original space as unoccupied.

I'm not sure of the mechanics of this aspect of file/disk management.

But let's say it did overwrite the same sectors used by the original. That
would mean a few KB of the original file would be gone.

Let's say the each block is 4 KB in size, the new blank document is likely
to be less than this, so all but 4 KB of the original document is likely to
be recoverable, (because a file can occupy no less than one sector of data.
Any unused space is known as "slack").
 
Animenia said:
Sorry Dave but NO.
If the CONTENT of the dokument is deleted and you save the dokument
the content is unrecoverable.
Click to expand...

Not exactly the case. If the document was created in Word (and some other
programs) simply deleting the contents is but a "revision" to the document
and several generations of "revisions" may be imbedded in the .DOC file.
This feature enables the user to 'back-out' of a any number of document
modifications and return to the original or any other point in the
document's life-cycle.

We've all seen cases where some sensitive material is 'blacked out' and the
resulting document file distributed. Enterprising folks can erase the
'blacked-out' area to discover what the distributor hoped was hidden.

This technique is also available for Acrobat files and probably others.
 
Back
Top