Printable View
Hey:
I recently read in one of my mags how when you delete a directory or file from your harddrive, what your really removing is the tag in the FAT table that says that file exists, but the data is still written there, until the pc needs more space (then it rewrites).
You guys know anything about this?
Hi
What exactly do you want to ask here...You are looking for Something to restore those files back or just general information of what happens when you delete a file...
When a file is created three things occur:
1. An entry is made into the File Allocation Table (FAT) to indicate where the actual data is stored in the Data Area. (A File Allocation Table is the means by which the operating system keeps track of where the pieces of a file are stored on a hard disk.)
2. A Directory entry is made to indicate file name, size, the link to the FAT and other information.
3. The data is written to the Data Area
When a file is deleted only two things occur:
1. The File Allocation Table entry for that particular file is zeroed out and shown as available for use by a new file.
2. The first character of the Directory Entry file name is changed to a special character. (E5 HEX)
3. Nothing is done to the Data Area. The data is untouched.
When a file is restored only two things need to be done:
1. The File Allocation Table entry for that particular file is linked to the particular location in the data area where the file data is stored.
2. The first character of the Directory Entry file name is changed to a legal character.
3. Nothing is done to the Data Area.
There are many Software Avaliable to recover the Deleted data but their Efficincy depends on certain factors such as ..time ..amount of new data being written on the disk..etc etc...if you want to recover it you have to do it as soon as possible giving you better chance of recovering it fully
You can also read about a few Details about the info2 file in this thread need info about info2
--Good Luck--
Here is a article about how two MIT students recovered data from drives that were wiped
http://www.bankrate.com/ThirdAge/new...20030711a1.asp
and here is a pdf file that has some recovery links in it
www.computer.org/security/garfinkel.pdf
On a side note data is never completely overwritten and can still be recovered through very expensive means. What happens is that the write head tends to jitter just a bit when writing data so it never really writes over the same place twice. Hence why file wiping and erasure programs do multiple overwrites of the file. But this is a whole nother discussion that I wont get into. Just adding it as a side note