16/05/2017
National Cyber Safety and Security Standards
Here is What Happens When You Delete a File or Folder
It happens. You delete a folder or format a memory card without realizing that it contained some crucial file, photo, or document. Fortunately, there are a number of ways you can recover or “undelete” that file. However, it’s not magic and you won’t be able to recover 100% of your file 100% of the time. To understand what affects your chances for a successful file recovery and what you can do to increase those chances, it’s worthwhile to learn what happens when you delete a file. And that’s precisely what we’ll talk about in this article.
Into the Trash Bin
When it comes to removing unwanted files, each of the major operating systems has some sort of “trash” bin. This is a staging area where your files when you first hit “delete.” In Linux, it’s usually called the Trash Bin. For Mac OS X, it’s simply the Trash. And for Windows, it’s the Recycle Bin.
Just like the recycle bin in your kitchen, the stuff you toss in your computer’s Recycle Bin doesn’t disappear immediately. Until it fills up and gets emptied, you can still go in and easily pick your stuff out, pretty much intact. When you do end up “taking out the trash,” recovering your stuff becomes more difficult. But it’s still possible.
Files get purged from the Recycle Bin in one of two ways: when it gets full, the system will start removing them (i.e. “permanently” deleting them) on a first in, first out basis. Or, you can choose to manually empty the Recycle Bin to free up disk space. When this happens, you can no longer restore your file simply by opening your Recycle Bin, right-clicking the file and clicking Restore.
So, What Happens Beyond the Trash Bin
So, what happens when a file gets emptied from the Recycle Bin? With a few rare exceptions, your file does not instantly cease to exist. Instead, the system simply changes a bit in the file allocation table that marks the space occupied by that file as “free.” True to the Recycle Bin’s name, the bits and bytes that make up your deleted file are eventually reused to store other files. But this doesn’t happen until the space is actually needed. Until your file is overwritten by new data, it’s still sitting there on your disk somewhere, wholly intact. The only difference is that the file allocation table is no longer keeping track of it.
Summary
That’s what happens when you delete a file in a nutshell. This has been a very high level discussion of the overall process, but it should help you understand how file recovery works and why certain approaches are better than others. You basically have two chances to undelete a file: (1) by restoring it from the Recycle Bin or Trash Bin and (2) by recovering it before it’s overwritten by new data. Keep this in mind for the next time you accidentally delete an important file.
Source: https://codingsec.net/2016/05/happens-delete-file-folder/
