Sign in with
Sign up | Sign in
Your question

How can file be permanently deleted but still recoverable

Last response: in Windows XP
Share
Anonymous
July 25, 2005 9:24:03 PM

Archived from groups: microsoft.public.windowsxp.general (More info?)

Hi
why do people say that they have deleted a file from their computer but if
someone has enough knowledge or certain forensic software they can still
retrieve this file that was supposably deleted. If they can retrieve it then
it is not deleted. and when the file is supposably deleted but still in your
computer is there a difference in the space that it takes in hidden areas of
your computer. I would imagine that they would be compressed or sometthing
else.
Anonymous
July 26, 2005 12:58:47 AM

Archived from groups: microsoft.public.windowsxp.general (More info?)

Hi,

Deleting a file just removes the reference to it, and marks the space it
occupies as available. The file itself and the space it occupies remains "as
is" until something overwrites it. This is the basis of the many recovery
programs, as they identify these files and allow a user to "recover" them.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Associate Expert - WindowsXP Expert Zone
www.microsoft.com/windowsxp/expertzone
Windows help - www.rickrogers.org

"new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
in message news:3D19F9E7-D477-4E19-AEE8-A4076F421C75@microsoft.com...
> Hi
> why do people say that they have deleted a file from their computer but if
> someone has enough knowledge or certain forensic software they can still
> retrieve this file that was supposably deleted. If they can retrieve it
> then
> it is not deleted. and when the file is supposably deleted but still in
> your
> computer is there a difference in the space that it takes in hidden areas
> of
> your computer. I would imagine that they would be compressed or sometthing
> else.
Anonymous
July 26, 2005 12:58:48 AM

Archived from groups: microsoft.public.windowsxp.general (More info?)

Thanks for replying to my post
Can you elaborate what you mean by removes the reference to it. what do you
mean by reference. Is it true that when a file gets deleted a letter from the
filename gets removed and replaced with another character or something like
that.

"Rick "Nutcase" Rogers" wrote:

> Hi,
>
> Deleting a file just removes the reference to it, and marks the space it
> occupies as available. The file itself and the space it occupies remains "as
> is" until something overwrites it. This is the basis of the many recovery
> programs, as they identify these files and allow a user to "recover" them.
>
> --
> Best of Luck,
>
> Rick Rogers, aka "Nutcase" - Microsoft MVP
> http://mvp.support.microsoft.com/
> Associate Expert - WindowsXP Expert Zone
> www.microsoft.com/windowsxp/expertzone
> Windows help - www.rickrogers.org
>
> "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
> in message news:3D19F9E7-D477-4E19-AEE8-A4076F421C75@microsoft.com...
> > Hi
> > why do people say that they have deleted a file from their computer but if
> > someone has enough knowledge or certain forensic software they can still
> > retrieve this file that was supposably deleted. If they can retrieve it
> > then
> > it is not deleted. and when the file is supposably deleted but still in
> > your
> > computer is there a difference in the space that it takes in hidden areas
> > of
> > your computer. I would imagine that they would be compressed or sometthing
> > else.
>
>
>
Related resources
July 26, 2005 12:58:49 AM

Archived from groups: microsoft.public.windowsxp.general (More info?)

new office 2003 user wrote:

> Thanks for replying to my post
> Can you elaborate what you mean by removes the reference to it. what
> do you mean by reference. Is it true that when a file gets deleted a
> letter from the filename gets removed and replaced with another
> character or something like that.

No. It will help if you think of the operating system setting a little
"flag" on files that says basically (simplistically) "this is a good
file, don't overwrite it with any other data". Then when you delete the
file, that "flag" gets removed and the system knows it is OK to write
to that previously reserved area on the hard drive. The data is still
there until it gets overwritten by something else. That's why when
someone needs to recover data, we tell them to immediately stop working
on the machine. This is to prevent any data from being written to that
area on the hard drive. Then, as you were told, there is specialized
data recovery software that can see the files where the "flag" was
removed and retrieve them - up to a point.

HTH,

Malke
--
MS-MVP Windows User/Shell
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic"
Anonymous
July 26, 2005 12:58:49 AM

Archived from groups: microsoft.public.windowsxp.general (More info?)

In the ol' days of DOS, using the 8.3 naming convention (8 characters for the
filename, 3 characters for the filename extension to identify the type of
data stored in the file), deleting the file would result in the last
character of the filename being replaced.

If you knew the full filename, no problem. If you had deleted say, all of
the files used by an application, then changed your mind, you would have to
know or be able to figure out what the missing letter should have been.

I don't know if the process is still the same for long filenames under
Windows XP.
--
Cordially,
Wayne H. Wilhelm
Personal Web: http://www.quadracalc.com


"new office 2003 user" wrote:

> Thanks for replying to my post
> Can you elaborate what you mean by removes the reference to it. what do you
> mean by reference. Is it true that when a file gets deleted a letter from the
> filename gets removed and replaced with another character or something like
> that.
>
> "Rick "Nutcase" Rogers" wrote:
>
> > Hi,
> >
> > Deleting a file just removes the reference to it, and marks the space it
> > occupies as available. The file itself and the space it occupies remains "as
> > is" until something overwrites it. This is the basis of the many recovery
> > programs, as they identify these files and allow a user to "recover" them.
> >
> > --
> > Best of Luck,
> >
> > Rick Rogers, aka "Nutcase" - Microsoft MVP
> > http://mvp.support.microsoft.com/
> > Associate Expert - WindowsXP Expert Zone
> > www.microsoft.com/windowsxp/expertzone
> > Windows help - www.rickrogers.org
> >
> > "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
> > in message news:3D19F9E7-D477-4E19-AEE8-A4076F421C75@microsoft.com...
> > > Hi
> > > why do people say that they have deleted a file from their computer but if
> > > someone has enough knowledge or certain forensic software they can still
> > > retrieve this file that was supposably deleted. If they can retrieve it
> > > then
> > > it is not deleted. and when the file is supposably deleted but still in
> > > your
> > > computer is there a difference in the space that it takes in hidden areas
> > > of
> > > your computer. I would imagine that they would be compressed or sometthing
> > > else.
> >
> >
> >
July 26, 2005 7:14:54 PM

Archived from groups: microsoft.public.windowsxp.general (More info?)

"new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
in message news:1B7918B0-F1DF-4ECF-A8EF-051F273F0D38@microsoft.com...
> Thanks for replying to my post
> Can you elaborate what you mean by removes the reference to it. what do
you
> mean by reference. Is it true that when a file gets deleted a letter from
the
> filename gets removed and replaced with another character or something
like
> that.
>
The is a file on the HD which contains the list of files. Each entry of
this list shows the file name, where on the HD that the file starts, and
whether the file is valid or not. That is amoung many other things about
the file. When you delete a file, the valid marker is changed from valid to
deleted. Nothing else about the file gets changed. So, it is a simple task
to find files that are marked invalid and resurrect them. However, the OS
is free to reuse the space occupied by invalid files whenever it needs to
create a new file. Thus, a recovery may not be possible if there has been
very much file activity in the meantime.
Jim
Anonymous
July 26, 2005 7:14:55 PM

Archived from groups: microsoft.public.windowsxp.general (More info?)

"Jim" <j.n@nospam.com> wrote in message
news:o rsFe.2132$PC7.641@newssvr29.news.prodigy.net...
>
> "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
> in message news:1B7918B0-F1DF-4ECF-A8EF-051F273F0D38@microsoft.com...
>> Thanks for replying to my post
>> Can you elaborate what you mean by removes the reference to it. what do
> you
>> mean by reference. Is it true that when a file gets deleted a letter from
> the
>> filename gets removed and replaced with another character or something
> like
>> that.
>>
> The is a file on the HD which contains the list of files. Each entry of
> this list shows the file name, where on the HD that the file starts, and
> whether the file is valid or not. That is amoung many other things about
> the file. When you delete a file, the valid marker is changed from valid
> to
> deleted. Nothing else about the file gets changed. So, it is a simple
> task
> to find files that are marked invalid and resurrect them. However, the OS
> is free to reuse the space occupied by invalid files whenever it needs to
> create a new file. Thus, a recovery may not be possible if there has been
> very much file activity in the meantime.
> Jim
>
>
Doesn't defrag reclaim that wasted space and make the left over deleted
files go away?
Anonymous
July 26, 2005 7:14:56 PM

Archived from groups: microsoft.public.windowsxp.general (More info?)

"Jone Doe" wrote:

>
> "Jim" <j.n@nospam.com> wrote in message
> news:o rsFe.2132$PC7.641@newssvr29.news.prodigy.net...
> >
> > "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
> > in message news:1B7918B0-F1DF-4ECF-A8EF-051F273F0D38@microsoft.com...
> >> Thanks for replying to my post
> >> Can you elaborate what you mean by removes the reference to it. what do
> > you
> >> mean by reference. Is it true that when a file gets deleted a letter from
> > the
> >> filename gets removed and replaced with another character or something
> > like
> >> that.
> >>
> > The is a file on the HD which contains the list of files. Each entry of
> > this list shows the file name, where on the HD that the file starts, and
> > whether the file is valid or not. That is amoung many other things about
> > the file. When you delete a file, the valid marker is changed from valid
> > to
> > deleted. Nothing else about the file gets changed. So, it is a simple
> > task
> > to find files that are marked invalid and resurrect them. However, the OS
> > is free to reuse the space occupied by invalid files whenever it needs to
> > create a new file. Thus, a recovery may not be possible if there has been
> > very much file activity in the meantime.
> > Jim
> >
> >
> Doesn't defrag reclaim that wasted space and make the left over deleted
> files go away?
>

Not completely.

Defrag only condenses files into sequential sectors to keep the files from
being stored across a series of non-sequential sectors. The storage capacity
does not increase as a result of the defrag operation. Typically, this means
copying the files in a more organized manner into the first available sectors
of the HD, including sectors occupied by deleted data. Defrag pays attention
to the space occupied by deleted files only if that space will benefit the
defragmentation of data files.

If the deleted file was stored in sectors not accessed by the defrag
operation (defrag does not bother with all sectors on a HD), then that
deleted file will still be located on the HD, intact.

--
Cordially,
Wayne H. Wilhelm
Personal Web: http://www.quadracalc.com
!