The word ‘delete’ as it applies to computers gives you the impression that the file has been removed from the system. That it is gone and cannot be found or recovered. Clearly this is not the case, as Windows provides you with a Recycle Bin which allows you to undelete files - clearly indicating that deleted files are not completely removed from your hard drive.
So what exactly does the Delete command do?
When you delete a file, the system simply takes the first bit of the file and replaces it with another bit. This bit signals to the system that the file is no longer available to the system and the sectors it was using may now be used by another file.
The significance of this:
- Depending on the system and resources, those sectors may not be overwritten until some point in the future. That means for a period of time, the information contained within those sectors is still resident in the system, and therefore can be read.
- Software has created for just this purpose: to be able to read, at a low level, the contents of a system. These tools can find the ‘deleted’ information because they read all of the sectors on a system at a low level.
Unfortunately, the Recycle Bin doesn’t always recover your files - in particular those deleted :
- Through the command prompt,
- By a DOS program, or
- By an early generation software program - typically 16-bit software - which is not even aware that the Recycle Bin exists.
Obviously, once you empty the Recycle Bin, the files that it contained cannot be recovered - at least by the Recycle Bin.
There are a number of Undelete software utilities that have far stronger Undelete capabilites than the Recycle Bin. These exploit the ‘altered first bit’ mentioned above, and should successfully recover your file, provided:
- You haven’t overwritten any clusters of the file, and
- No expert techniques were applied to the file to permanently erase it.