Why are permanently deleted file recoverable form a memory device?

If you have accidentally deleted some files don’t panic follow these steps.
1. Do not read, write or access that Drive.
2. Free File recovery software Use this to recover your file.

How can a permanently deleted file be recovered form any memory device. This is one thing all might be eager to know. The reason is simple. Every file system has got a MFT which has got the location of the files directories etc. Most of the time it includes the starting address, range of address etc and in rare cases MFT can actually hold the data of the file.

Master File Table is an upgraded version of a file allocation table (FAT). Instead of simply being a simple list of file addresses on a hard disc, the MFT contains the attributes of the file or directory itself. This information will include items such as name and address but also security details or permissions. If the file being tagged is small, the file data can actually be stored in the MFT entry, making the access of such data very fast.

So when we permanently delete the file, usually the data of file is not deleted but only the MFT entry is deleted. The space used by the file will be overwritten only when a new file is created or during de-fragmentation, formatting etc. A file recovery software will search for file headers and recover the lost files. If any part of the memory where the deleted file was stored had been over written by another file, you will get a partial recovery.

This overwriting can some times lead to fun. When I once recovered an MPG file the some part of the memory was already used by Windows to write some mp3 files. So when I played the file after recovery I was hearing music from several different songs instead of the Video.

Why does an Operating System not delete the contents of a file from the memory device? The answer is simple - to save time and resources. Normally if each byte of a file is written to an arbitrary value so that the file is unrecoverable the deleting process would take many minutes for a normal video. So to save time the OS will simply delete the entry from the tables and act as if the file never existed.

Buy me a cup of hot coffee - help me keep posting all through the night

If you are new here you may want to subscribe to this blogs full feed RSSSubscribe to full feed RSS of this blog
so that you will get the updates automatically to your feed reader.

Tags: , , ,

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

RSS feed | Trackback URI

2 Comments »

Name (required)
E-mail (required - never shown publicly)
URI
Subscribe to comments via email
Your Comment (smaller size | larger size)
You may use <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong> in your comment.

Trackback responses to this post



My Google  Netvibes  My Yahoo!  Windows Live  Bloglines  Newsgator