interalia

Where do deleted files go?

Decrease Font Size Increase Font Size Text Size Print This Page

By: MUKHTAR AHMAD FAROOQI

A common misconception among people while deleting computer files is that they are completely removed from the hard drive. When you first delete a file on a computer, it is moved to the computer's Recycle Bin, Trash, or something similar depending on your operating system. When something is sent to the Recycle Bin or Trash the icon changes to indicate it contains files and if needed allows you to recover deleted file.

Later, when you empty the Recycle Bin or Trash, the icon changes back to an empty trash can and the files are deleted. Any time when a file is deleted from hard drive, it is not erased. What is erased is the bit of information that points to the location of the file on the hard drive.

The operating system uses these pointers to build the directory tree structure (the file allocation table), which consists of the pointers for every other file on the hard drive. To make the concept simple, on any hard disk there is a File Allocation Table (FAT) which says something like File X is stored at location A when the user requests access to File X, the table points the user to location A.

When user requests permanent deletion of the File X, the location A is marked empty inside the file table. Therefore the File X stays there but to the user the location A is nothing but reusable empty space which means the space is available for new data.

To simplify this, think about how you access a chapter inside a book, the index page tells you which chapter is on which page, if you want to delete any chapter just mark it as empty on index page, the user thinks that particular page number has blank pages and he can use those blank pages to write new information but it does not change the fact that these pages are still full with that information.

When the pointer is erased, the file essentially becomes invisible to the operating system. The file still exists as long as no new data had been written over the sectors that originally housed that information. The operating system doesn't know how to find that. It is, however, relatively easy to retrieve deleted files with the right software. Some of these softwares are free which have limitations as far as the size and numbers files that can be recovered while paid versions do not have these limitations. Because the file is technically there, it may be able to be recovered using data recovery software, designed to rebuild the file header and allow the computer to see the file again.One thing should be born in mind that a file is recoverable till no data has been saved on that location and it becomes nearly impossible to recover if the location has been overwritten. Let’s understand this by using a real life .Suppose you deleted a photo from your SD card and then saved another photo immediately on same SD card , then photo gets saved on the same location where the photo was saved which makes it nearly impossible to recover that accidentally deleted photo.

This software only works if no other file or data has been saved over the top of the deleted file. The only way to completely erase a file with no trace is to overwrite the data. Running a low-level format or another utility that overwrites all deleted files with zeros or other garbage is the only method of making sure files cannot be recovered.

A low-level format can also be called a zero fill, because of the writing of the zeroes to the hard drive. When the deleted file space is overwritten by zeroes or any other data it is no longer able to be recovered.

Leave a Reply

Your email address will not be published. Required fields are marked *