What actually happens when a file is deleted ?

Hi !!
I might get flamed for asking this but I was wondering as to what actually happens when a file gets deleted ? Is it removed off the hard disk or is it converted in an unreadable format ? Because I have seen that many a times a deleted file can be retrieved using some trick. Is some advanced algorithm converts the file in an un readable format when, say in a windows environment, the file is put in recycle bin and then deleted or deleted by just pressing the delete button ? Is the method of deletion different in Windows and Unix ?

I would be etremely thankful if someone could answer the question.

I believe that unless you use some sort of a tool, the file's entry's just deleted from the HD lib.... But I mightbe wrong....

Thanks for replying so fast. But I want to know how a file gets deleted. ITs not that I want to retrieve a deleted file or something like that. But thanks for answering.

On a PC, when you delete a file, you are actually doing three things:

1. Erasing the first letter of the filename
2. Removing the file's location from the file allocation system
3. Allowing the area that stored the data of the file to be written to.


Someone attempting to undelete would look into unallocated space for what looked like an ordered file. Then they would remark that space as reserved for a file, but the first letter would have to be manually recovered.

However, this has the drawback of not being foolproof, or even reliable. If a file is deleted and then immediately an undelete program is applied to it, it stands a good chance of being completely recovered. However, if a file is deleted and then the space that contained it is reused (a newly saved file took the vacant space) then an undeleter is useless.

For people wishing to PREVENT file recovery, utilities do exist. Offhand I can think of Shredder, which overwrites the allocation area of a file with garbage data, preventing any recovery.


Windows adds an extra step of idiot proofing to this process, the Recycle Bin. When you click to delete, or drag an item to the Bin, it is not actually deleted, just moved to a hidden folder on the C:\ drive. Only when a user selects Empty Recycle Bin are files actually deleted.

As cheez said, the file is not deleted. The blocks that constituted the file are just flagged as free in the disc allocation table. That is why, if nothing else has grabbed those blocks in the mean time, you can "undelete" the file by restoring the allocation table entries.

***EDIT***

Whoops, concurrency again!

Hi !!
Thanks a lot for answering my questions. Thats the reason why I post my questions here. Its the "only" place where I get real answers from real programmers like you. Thanks again for answering the questions. I would be even more thankful if you could tell me how it happens on a Unix OS.

to delete a file to where it can't be recovered you have to delete and write over the data 8 times, well, if you've got something that important anyway, your probably got a sniper aiming at your head as we speak.

>
Windows adds an extra step of idiot proofing to this process, the Recycle Bin. When you click to delete, or drag an item to the Bin, it is not actually deleted, just moved to a hidden folder on the C:\ drive. Only when a user selects Empty Recycle Bin are files actually deleted.
<

don't use it.

just his Shift + Delete to skip it.

hm.. I'm gonna make a file shredder which replaces every letter of the file with '1', then deletes it. Would that do the trick?

Maybe I could sell it...

They have disk wipe utilities already that write ones to the dive and then zero it.