What Happens during Delete
and Undelete ???
Files are stored in tracks and sectors on the
drives and NEVER wiped off but can be over-copied.
If you can imagine that the drive has a table of
contents, then when a file is deleted it IS ONLY REMOVED FROM THE TABLE OF
CONTENTS, the actual file still resides in the same track/sectors position.
Because it is removed from the table of
contents, the system knows that the disk area detailed for this file in the
table, is an area that can be used for another file. The actual file whilst not
accessible (because you access files by their reference in the table), is still
present on the disk.
On saving new files to the drive, the system
looks for unallocated areas in the table of contents and thus the area relating
to deleted table entries, can now be used to store the new file(s).
SO HOW CAN THE DELETED FILES BE RECOVERED ??
Ok, the table of contents is in fact called the
FILE ALLOCATION TABLE (FAT). From Windows 95 ver2 Win98, Win2000, this is a
32bit table, In Windows95 version 1, it is a 16bit table.
Now if we have a backup table (another copy)…and
file deletions only take out entries in the main table…then the entries are
still there in the backup FAT.
So….provided that the original area of the disk
detailed by the now deleted entries has NOT been over-copied by newly saved
files………ALL THAT IS NEEDED IS TO RESTORE the deleted FAT entries from the
backup FAT. The entries in the main FAT are restored and you can now reference
them again (retrieve them again) and see the file(s) in a window view of the
original folder they were in.
THE MORAL OF THE STORY
- Have a file undelete
program
- Use it as soon after
a deletion as possible
- BE MORE CAREFUL IN
FUTURE when deleting.