Thursday, November 18, 2010

How files are deleted

To understand how it is possible to recover deleted files it helps to know what happens when a file is deleted. I've mentioned the Recycle Bin already. It's a folder where files are moved to when you delete them from another folder so they can easily be recovered. But what happens to files when you empty the Recycle Bin, delete them from a removable drive, a memory card or a network drive, or use Shift+Delete to bypass the Recycle Bin?

Exactly what happens depends on the system used to organize files on your hard drive or other storage medium (the file system) but the details aren't really important. In essence, two things happen. A flag in the record for that file in the folder is changed to show it as deleted and the space on the drive that contained the data of the file is marked as available for re-use by the operating system. Although the file no longer appears in the folder and has gone as far as the operating system is concerned, the data has not been erased and the file is still fully recoverable.

If you act immediately you realize your mistake using a deleted files recovery software like Uneraser, you have a 100% chance of recovering that deleted file. This is the easiest task for recovery software. The file's record is still present in the folder containing all the details of the file including it's name, type, size, date created and date modified and the location of the file's data. All the recovery software has to do is clear the deleted flag from the record, remove the space holding the data from the free disk space pool and your file is back where it was originally.

As time passes since the file was deleted, two things will happen. The record containing the details of the deleted file will be reused to store information about a new file. And the space that held the file data will start to be overwritten by other data. There is no way to predict how long that will take. When testing data recovery software I have been surprised at some of the long-forgotten files that have been recovered. But I have also found more recently deleted files that could not be recovered perfectly because some of the original data had been overwritten. It depends on things like the size of the hard drive relative to the space you are using, how much you use the computer, whether you create many big files and where on the hard drive the file you deleted was stored.

To have the best chance of recovering deleted files, act as quickly as possible. Ideally you should stop using the computer and either take the hard drive out and attach it to another PC to run the data recovery or you should use bootable recovery media. We will look at these options in future postings.