Hard Drive Deletion Analisys
Results 1 to 4 of 4

Thread: Hard Drive Deletion Analisys

  1. #1
    Member
    Join Date
    Jun 2003
    Posts
    58

    Question Hard Drive Deletion Analisys

    Hey:

    I recently read in one of my mags how when you delete a directory or file from your harddrive, what your really removing is the tag in the FAT table that says that file exists, but the data is still written there, until the pc needs more space (then it rewrites).


    You guys know anything about this?
    \"I ONLY DRINK THE BLOOD OF MY ENEMIES....and maybe a strawberry yoohoo....and a...Pina Co-la-da!...
    If you like pina coladas....ugh!, gettin\' caught in the rain....ugh!\"
    -Sarge

  2. #2
    AntiOnline n00b
    Join Date
    Feb 2004
    Posts
    665
    Hi

    What exactly do you want to ask here...You are looking for Something to restore those files back or just general information of what happens when you delete a file...

    When a file is created three things occur:

    1. An entry is made into the File Allocation Table (FAT) to indicate where the actual data is stored in the Data Area. (A File Allocation Table is the means by which the operating system keeps track of where the pieces of a file are stored on a hard disk.)

    2. A Directory entry is made to indicate file name, size, the link to the FAT and other information.

    3. The data is written to the Data Area

    When a file is deleted only two things occur:

    1. The File Allocation Table entry for that particular file is zeroed out and shown as available for use by a new file.

    2. The first character of the Directory Entry file name is changed to a special character. (E5 HEX)

    3. Nothing is done to the Data Area. The data is untouched.


    When a file is restored only two things need to be done:

    1. The File Allocation Table entry for that particular file is linked to the particular location in the data area where the file data is stored.

    2. The first character of the Directory Entry file name is changed to a legal character.

    3. Nothing is done to the Data Area.


    There are many Software Avaliable to recover the Deleted data but their Efficincy depends on certain factors such as ..time ..amount of new data being written on the disk..etc etc...if you want to recover it you have to do it as soon as possible giving you better chance of recovering it fully

    You can also read about a few Details about the info2 file in this thread need info about info2

    --Good Luck--

  3. #3
    Senior Member DeadAddict's Avatar
    Join Date
    Jun 2003
    Posts
    2,583
    Here is a article about how two MIT students recovered data from drives that were wiped
    http://www.bankrate.com/ThirdAge/new...20030711a1.asp

    and here is a pdf file that has some recovery links in it
    www.computer.org/security/garfinkel.pdf

  4. #4
    Senior Member
    Join Date
    Jul 2002
    Location
    Texas
    Posts
    168
    On a side note data is never completely overwritten and can still be recovered through very expensive means. What happens is that the write head tends to jitter just a bit when writing data so it never really writes over the same place twice. Hence why file wiping and erasure programs do multiple overwrites of the file. But this is a whole nother discussion that I wont get into. Just adding it as a side note
    <chsh> I've read more interesting technical discussion on the wall of a public bathroom than I have at AO at times

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides