Learn about the technologies behind the Internet with The TCP/IP Guide!
NOTE: Using robot software to mass-download the site degrades the server and is prohibited. See here for more.
Find The PC Guide helpful? Please consider a donation to The PC Guide Tip Jar. Visa/MC/Paypal accepted.
View over 750 of my fine art photos any time for free at DesktopScenes.com!

[ The PC Guide | Systems and Components Reference Guide | Hard Disk Drives | Hard Disk Logical Structures and File Systems | Clusters and File Allocation ]

File Deletion and Undeletion

As you use any PC, you will routinely create and delete files. Now, deleting a file means to erase it from the disk, which you would think means the file is destroyed. Naturally, you would only do this to files you no longer need. However, in many circumstances, it is useful to be able to "undo" the results of deleting a file. Accidental deletions happen far more often than you might imagine, believe me. :^)

One of the advantages of the FAT file system is the ease with which it allows for files to be undeleted, because of the way that it deletes files. Contrary to what many people believe, deleting a file does not result in the contents of the file actually being removed from the disk. Instead, the system places the hex byte code E5h into the first letter of the file name of the file. This is a special tag that tells the system "this file has been deleted". The space that was formerly used by the file is available for use by other files, but it is not cleared. It is just sort of "left there".

Over time, these "freed" clusters will eventually be reused by other files, as they request more space for storage. However, if you accidentally delete a file you can very often recover it if you act quickly. In DOS you can use the UNDELETE command. There are also third-party tools that will undelete files, such as Norton Utilities' UNERASE. If you run one of these tools immediately, it can identify and recover the deleted files in a directory. You will have to provide the software with the missing first character of the file name (which was overwritten by the E5h code in that file's directory entry when the file was deleted).

The less work you do between the time the file is deleted and the time when you try to undelete it, the more likely you will be able to recover the file. If you delete a file on a system that is fairly full, and then start making many new files, some of the clusters formerly used by the deleted file may be reused, and their former contents lost. Obviously, if you defragment your disk or do some other large-scale disk work, you will most likely lose the contents of deleted files forever.

Many operating systems have made deletion and undeletion less of an issue by integrating protection for erased files into the operating system itself. Newer Windows versions send all deleted files initially to a "Recycle Bin", from which they can be restored if needed. These deleted files stay around for a while, in case you want to undelete them, and if they are in the Recycle Bin they can be restored to their former locations with no data loss. However, the size of the Recycle Bin is limited and eventually files will be permanently removed from it.

Warning: If you value your files, you will not rely too much on the capabilities of utilities that restore deleted files. They are no substitute at all for proper backup procedures.

Next: Fragmentation and Defragmentation

Home  -  Search  -  Topics  -  Up

The PC Guide (http://www.PCGuide.com)
Site Version: 2.2.0 - Version Date: April 17, 2001
Copyright 1997-2004 Charles M. Kozierok. All Rights Reserved.

Not responsible for any loss resulting from the use of this site.
Please read the Site Guide before using this material.
Custom Search