How can file be permanently deleted but still recoverable

Archived from groups: microsoft.public.windowsxp.general (More info?)

Hi
why do people say that they have deleted a file from their computer but if
someone has enough knowledge or certain forensic software they can still
retrieve this file that was supposably deleted. If they can retrieve it then
it is not deleted. and when the file is supposably deleted but still in your
computer is there a difference in the space that it takes in hidden areas of
your computer. I would imagine that they would be compressed or sometthing
else.
7 answers Last reply
More about file permanently deleted recoverable
  1. Archived from groups: microsoft.public.windowsxp.general (More info?)

    Hi,

    Deleting a file just removes the reference to it, and marks the space it
    occupies as available. The file itself and the space it occupies remains "as
    is" until something overwrites it. This is the basis of the many recovery
    programs, as they identify these files and allow a user to "recover" them.

    --
    Best of Luck,

    Rick Rogers, aka "Nutcase" - Microsoft MVP
    http://mvp.support.microsoft.com/
    Associate Expert - WindowsXP Expert Zone
    www.microsoft.com/windowsxp/expertzone
    Windows help - www.rickrogers.org

    "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
    in message news:3D19F9E7-D477-4E19-AEE8-A4076F421C75@microsoft.com...
    > Hi
    > why do people say that they have deleted a file from their computer but if
    > someone has enough knowledge or certain forensic software they can still
    > retrieve this file that was supposably deleted. If they can retrieve it
    > then
    > it is not deleted. and when the file is supposably deleted but still in
    > your
    > computer is there a difference in the space that it takes in hidden areas
    > of
    > your computer. I would imagine that they would be compressed or sometthing
    > else.
  2. Archived from groups: microsoft.public.windowsxp.general (More info?)

    Thanks for replying to my post
    Can you elaborate what you mean by removes the reference to it. what do you
    mean by reference. Is it true that when a file gets deleted a letter from the
    filename gets removed and replaced with another character or something like
    that.

    "Rick "Nutcase" Rogers" wrote:

    > Hi,
    >
    > Deleting a file just removes the reference to it, and marks the space it
    > occupies as available. The file itself and the space it occupies remains "as
    > is" until something overwrites it. This is the basis of the many recovery
    > programs, as they identify these files and allow a user to "recover" them.
    >
    > --
    > Best of Luck,
    >
    > Rick Rogers, aka "Nutcase" - Microsoft MVP
    > http://mvp.support.microsoft.com/
    > Associate Expert - WindowsXP Expert Zone
    > www.microsoft.com/windowsxp/expertzone
    > Windows help - www.rickrogers.org
    >
    > "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
    > in message news:3D19F9E7-D477-4E19-AEE8-A4076F421C75@microsoft.com...
    > > Hi
    > > why do people say that they have deleted a file from their computer but if
    > > someone has enough knowledge or certain forensic software they can still
    > > retrieve this file that was supposably deleted. If they can retrieve it
    > > then
    > > it is not deleted. and when the file is supposably deleted but still in
    > > your
    > > computer is there a difference in the space that it takes in hidden areas
    > > of
    > > your computer. I would imagine that they would be compressed or sometthing
    > > else.
    >
    >
    >
  3. Archived from groups: microsoft.public.windowsxp.general (More info?)

    new office 2003 user wrote:

    > Thanks for replying to my post
    > Can you elaborate what you mean by removes the reference to it. what
    > do you mean by reference. Is it true that when a file gets deleted a
    > letter from the filename gets removed and replaced with another
    > character or something like that.

    No. It will help if you think of the operating system setting a little
    "flag" on files that says basically (simplistically) "this is a good
    file, don't overwrite it with any other data". Then when you delete the
    file, that "flag" gets removed and the system knows it is OK to write
    to that previously reserved area on the hard drive. The data is still
    there until it gets overwritten by something else. That's why when
    someone needs to recover data, we tell them to immediately stop working
    on the machine. This is to prevent any data from being written to that
    area on the hard drive. Then, as you were told, there is specialized
    data recovery software that can see the files where the "flag" was
    removed and retrieve them - up to a point.

    HTH,

    Malke
    --
    MS-MVP Windows User/Shell
    Elephant Boy Computers
    www.elephantboycomputers.com
    "Don't Panic"
  4. Archived from groups: microsoft.public.windowsxp.general (More info?)

    In the ol' days of DOS, using the 8.3 naming convention (8 characters for the
    filename, 3 characters for the filename extension to identify the type of
    data stored in the file), deleting the file would result in the last
    character of the filename being replaced.

    If you knew the full filename, no problem. If you had deleted say, all of
    the files used by an application, then changed your mind, you would have to
    know or be able to figure out what the missing letter should have been.

    I don't know if the process is still the same for long filenames under
    Windows XP.
    --
    Cordially,
    Wayne H. Wilhelm
    Personal Web: http://www.quadracalc.com


    "new office 2003 user" wrote:

    > Thanks for replying to my post
    > Can you elaborate what you mean by removes the reference to it. what do you
    > mean by reference. Is it true that when a file gets deleted a letter from the
    > filename gets removed and replaced with another character or something like
    > that.
    >
    > "Rick "Nutcase" Rogers" wrote:
    >
    > > Hi,
    > >
    > > Deleting a file just removes the reference to it, and marks the space it
    > > occupies as available. The file itself and the space it occupies remains "as
    > > is" until something overwrites it. This is the basis of the many recovery
    > > programs, as they identify these files and allow a user to "recover" them.
    > >
    > > --
    > > Best of Luck,
    > >
    > > Rick Rogers, aka "Nutcase" - Microsoft MVP
    > > http://mvp.support.microsoft.com/
    > > Associate Expert - WindowsXP Expert Zone
    > > www.microsoft.com/windowsxp/expertzone
    > > Windows help - www.rickrogers.org
    > >
    > > "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
    > > in message news:3D19F9E7-D477-4E19-AEE8-A4076F421C75@microsoft.com...
    > > > Hi
    > > > why do people say that they have deleted a file from their computer but if
    > > > someone has enough knowledge or certain forensic software they can still
    > > > retrieve this file that was supposably deleted. If they can retrieve it
    > > > then
    > > > it is not deleted. and when the file is supposably deleted but still in
    > > > your
    > > > computer is there a difference in the space that it takes in hidden areas
    > > > of
    > > > your computer. I would imagine that they would be compressed or sometthing
    > > > else.
    > >
    > >
    > >
  5. Archived from groups: microsoft.public.windowsxp.general (More info?)

    "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
    in message news:1B7918B0-F1DF-4ECF-A8EF-051F273F0D38@microsoft.com...
    > Thanks for replying to my post
    > Can you elaborate what you mean by removes the reference to it. what do
    you
    > mean by reference. Is it true that when a file gets deleted a letter from
    the
    > filename gets removed and replaced with another character or something
    like
    > that.
    >
    The is a file on the HD which contains the list of files. Each entry of
    this list shows the file name, where on the HD that the file starts, and
    whether the file is valid or not. That is amoung many other things about
    the file. When you delete a file, the valid marker is changed from valid to
    deleted. Nothing else about the file gets changed. So, it is a simple task
    to find files that are marked invalid and resurrect them. However, the OS
    is free to reuse the space occupied by invalid files whenever it needs to
    create a new file. Thus, a recovery may not be possible if there has been
    very much file activity in the meantime.
    Jim
  6. Archived from groups: microsoft.public.windowsxp.general (More info?)

    "Jim" <j.n@nospam.com> wrote in message
    news:OrsFe.2132$PC7.641@newssvr29.news.prodigy.net...
    >
    > "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
    > in message news:1B7918B0-F1DF-4ECF-A8EF-051F273F0D38@microsoft.com...
    >> Thanks for replying to my post
    >> Can you elaborate what you mean by removes the reference to it. what do
    > you
    >> mean by reference. Is it true that when a file gets deleted a letter from
    > the
    >> filename gets removed and replaced with another character or something
    > like
    >> that.
    >>
    > The is a file on the HD which contains the list of files. Each entry of
    > this list shows the file name, where on the HD that the file starts, and
    > whether the file is valid or not. That is amoung many other things about
    > the file. When you delete a file, the valid marker is changed from valid
    > to
    > deleted. Nothing else about the file gets changed. So, it is a simple
    > task
    > to find files that are marked invalid and resurrect them. However, the OS
    > is free to reuse the space occupied by invalid files whenever it needs to
    > create a new file. Thus, a recovery may not be possible if there has been
    > very much file activity in the meantime.
    > Jim
    >
    >
    Doesn't defrag reclaim that wasted space and make the left over deleted
    files go away?
  7. Archived from groups: microsoft.public.windowsxp.general (More info?)

    "Jone Doe" wrote:

    >
    > "Jim" <j.n@nospam.com> wrote in message
    > news:OrsFe.2132$PC7.641@newssvr29.news.prodigy.net...
    > >
    > > "new office 2003 user" <newoffice2003user@discussions.microsoft.com> wrote
    > > in message news:1B7918B0-F1DF-4ECF-A8EF-051F273F0D38@microsoft.com...
    > >> Thanks for replying to my post
    > >> Can you elaborate what you mean by removes the reference to it. what do
    > > you
    > >> mean by reference. Is it true that when a file gets deleted a letter from
    > > the
    > >> filename gets removed and replaced with another character or something
    > > like
    > >> that.
    > >>
    > > The is a file on the HD which contains the list of files. Each entry of
    > > this list shows the file name, where on the HD that the file starts, and
    > > whether the file is valid or not. That is amoung many other things about
    > > the file. When you delete a file, the valid marker is changed from valid
    > > to
    > > deleted. Nothing else about the file gets changed. So, it is a simple
    > > task
    > > to find files that are marked invalid and resurrect them. However, the OS
    > > is free to reuse the space occupied by invalid files whenever it needs to
    > > create a new file. Thus, a recovery may not be possible if there has been
    > > very much file activity in the meantime.
    > > Jim
    > >
    > >
    > Doesn't defrag reclaim that wasted space and make the left over deleted
    > files go away?
    >

    Not completely.

    Defrag only condenses files into sequential sectors to keep the files from
    being stored across a series of non-sequential sectors. The storage capacity
    does not increase as a result of the defrag operation. Typically, this means
    copying the files in a more organized manner into the first available sectors
    of the HD, including sectors occupied by deleted data. Defrag pays attention
    to the space occupied by deleted files only if that space will benefit the
    defragmentation of data files.

    If the deleted file was stored in sectors not accessed by the defrag
    operation (defrag does not bother with all sectors on a HD), then that
    deleted file will still be located on the HD, intact.

    --
    Cordially,
    Wayne H. Wilhelm
    Personal Web: http://www.quadracalc.com
Ask a new question

Read More

Computers Microsoft Software Windows XP