Moving and deleting files

[T2R]

Hello,

I was wondering. It is known that if you delete a file on your drive, it doesn't mean that it is completely gone. Through proper tools, the file can be recovered.

Now the question I have is a bit different. If you were to move the file from one drive to another completely different and separate drive, then what? Is there any residuals of that file left on the original drive or does all the data go with the move?

 

[4745454b]

Nope, same difference. Moving (copy or cut/paste) files from one drive to another won't fully remove the files from the original drive.

 

[danny2000]

Well if you actually move the file that was deleted, then it wouldn't be deleted any longer, right?

Now, if you were you to clone the drive, then those deleted files should also be copied to the other drive also if they did a sector by sector copy of the hard drive.

 

[sewalk]

Moving a file across separate volumes is just combining copy and delete operations into a single command.

Deleting a file simply marks the entry for that file in the drive's file table as deleted or removes it from the table completely, depending on the actual file system design. The actual data blocks of the file itself are not touched.

 

[T2R]

Well, I just had moved a file from one drive to another drive and I don't want any residuals of that file, because it is important, to be left on the original drive. The file I moved was on my CPU hard drive but I moved it to my external, which I don't use a whole lot. Since I actually moved the whole file and its contents to another drive, there wouldn't be anything left on my CPU drive, right? As a matter of fact, I recall that I ran a full format of the drive and re-installed my OS on the CPU drive after the file had been moved.

 

[danny2000]

Well, I just had moved a file from one drive to another drive and I don't want any residuals of that file, because it is important, to be left on the original drive. The file I moved was on my CPU hard drive but I moved it to my external, which I don't use a whole lot. Since I actually moved the whole file and its contents to another drive, there wouldn't be anything left on my CPU drive, right? As a matter of fact, I recall that I ran a full format of the drive and re-installed my OS on the CPU drive after the file had been moved.

No, it would still be recoverable from the original drive.

 

[T2R]

Understood, so technically, besides getting a bunch of software to make passes at your drive to write 0's and 1's (which still isn't 100 percent), the other option you have is to pull the drive, run a magnet all over it and get a new drive into the PC?

 

[danny2000]

Windows 7 (and Vista Ultimate) have a built-in "previous versions" tab that can be used to recover/restore files after they are deleted or just changed.
Open Windows Explorer and right-click on the C: drive on the original hard drive.
Then click on "properties" and then on the "previous versions" tab to see what I mean.

 

[danny2000]

Understood, so technically, besides getting a bunch of software to make passes at your drive to write 0's and 1's (which still isn't 100 percent), the other option you have is to pull the drive, run a magnet all over it and get a new drive into the PC?

Yes.

 

[T2R]

Yes.

Well, when I opened that tab, the earliest one I saw was the one right after I re-installed my OS. There hasn't been another back-up before that point.

 

[sewalk]

Writing a drive full of zeros multiple times is 100% unless your nemesis has access to advanced forensic recovery software and talent and a whole lot of time. Your friend's uncle with his laptop isn't going to get jack.

Running a magnet all over the drive is even less likely to prevent data access unless you're talking about using a scrapyard crane electromagnet. If you grab one off the fridge, it won't do squat.

If you really want to make a drive unreadable, haul out a power drill and a hammer and wreak as much havoc as you can on the drive platters. Anything less than the full resources of a data recovery clean lab won't recover a single bit off of it and even those guys would be hard pressed to get anything usable.

 

[danny2000]

Well, when I opened that tab, the earliest one I saw was the one right after I re-installed my OS. There hasn't been another back-up before that point.

Yes, it will update them as you change the file in some in some way.

I was pointing-out that method of restoring files because just about anyone can use that who gets onto your computer, although some files may be limited to administrators I believe. That method only lets you recover files from your current install, and not previous installations. That is where software would come into play to recover deleted files.

 

[T2R]

I appreciate your input guys. Now if someone in the networking forum could answer my MAC address question as well, I'd be set.

 

[lucidica]

Here's a quick visual guide to what danny2000 was talking about with Previous Versions Restore Files with Previous Versions

 

[danny2000]

Here's a quick visual guide to what danny2000 was talking about with Previous Versions Restore Files with Previous Versions

A good link and depiction of it for the user. Thanks!