1

EDIT: So the question is Does Windows free up the disk space used by a file, is that data marked as deleted when it is moved to recycle bin upon deletion, or is it's pathname simply changed to recycle bin or to another folder(maybe a temp folder for Undo operations), and that data not marked as deleted until permenent?

Hello everyone, think I've found a solution here https://whereismydata.wordpress.com/2009/05/02/forensics-what-happens-when-files-are-deleted/

I know this is pretty specific to me

Basically I deleted a file and wanted to press Ctrl+z to undo that operation, this was not possible because I lost the undo button in File Explorer and Ctrl+Z.

The file is in Recycle Bin, but I want to make sure restoring that file is doing the same thing as Ctrl+z like I have tried to explain below. I mean if I left the data of the file while it still is in recycle bin Ctrl+z would be writing new data to restore that file

So I wanted to understand the process of Undo.

The research I did was read up on File systems, FAT, but I did not read up more on NTFS which I am using, I have a hdd rather than Solid state so I read about how data is stored as the polarity of a magnet 1 for a on bit or 0 for off. I looked into how Recovery software works, it will preserve the ones and zeroes of a file but not necessarily at the original location on disk so it preserves a copy of the file not necessarily the bits at their original locations, for linear addressing systems, this is relevent because if Undo/Delete does preserve bits at their original addresses recycle bin or temp preserves the original bits rather than copies of those bits.

When a file is deleted with del key, is a copy of that file made anywhere on hard disk, or is it only moved to recycle bin? I understand traces of the file may be left but does windows do anything else with that file?

user10502023
  • 19

1 Answers1

1

Depending on how you deleted the files. There are two common delete functions (Delete and Shift+Delete) each of these functions have a different process of deleting files and each have different recovery methods.

Delete

  • Not Permanent until files deleted from the Recycling Bin
  • Process: Deletes the file by moving the file to the Recycling Bin
  • Recovery Method: Restore the files from the Recycling Bin

Shift+Delete (Permanent)

  • Process: Permanently deletes the file by basically bypassing the Recycling Bin
  • Recovery Method: Using a recovery program to recover only if the data has not been overwritten.

There is a third way of deleting a file permanently referred to as zero filling which is a low-level format that just overwrites the data with zeroes.

The Recycle Bin is basically one bin with many folders, going into your Recycle Bin properties you can see almost all your drives have a recycle bin location of their own with their own maximum size settings.

So your files do move to a different folder.

angelofdev
  • 1,156