We all delete files on our computers and mobile devices every day, but where do those deleted files actually go? Are they still there in some form? Can they actually be recovered? Is the recovery process difficult?
Where do the deleted items go in a computer, and how can you retrieve them?
Marshall Brain Answers:
If you look at How Hard Disks Work, you can see that a traditional hard disk is a disk that is divided into thousands of sectors. Each sector holds a certain number of bytes (e.g. 512 bytes per sector) that is determined when you format the disk.
Let’s say your file is 10,000 bytes long. It is stored as a set of roughly 20 sectors on the disk.
Also on the disk is a set of sectors devoted to the disk’s directory. The directory remembers things like the names of the files on the disk, the date and time of creation, who owns the file, the folder that holds the file, etc., plus a pointer to the sectors that make up the file.
You delete a file by putting it in the “trash can”. The trash can is simply a special folder. The operating system takes the file’s entry from its current folder and moves it into the trash can folder. The actual sectors that hold the file’s data do not change or move.
To retrieve deleted files from the trash can, you can go the trash can, find the files and undelete them.
When you empty the trash can, the files no longer can be seen in the trash can and they are harder to recover. But chances are they still exist. An operating system like Windows in its normal mode will tend to leave the sectors for deleted files on the disk, and may even leave a record behind in the directory. The operating system simply marks the file name with a special character to say that it has been deleted. The actual sectors containing the file may not be reused for other files for many weeks (depending on how much free space is available on the drive).
You can download a program like Undelete from a place like Download.com to try to recover files that have been deleted from the trash can. It looks for deleted file names in the directory structure and shows them to you so you can undelete them.
