Most of the time, we rarely spare a thought for deleted files outside of knowing they are now out of our way, but what actually happens to those files when we delete them? Today’s SuperUser Q&A post has the answers to a curious reader’s questions about the deletion process.
Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-driven grouping of Q&A web sites.
Photo courtesy of Gerard’s World (Flickr).
The Question
SuperUser reader Shea A. wants to know what happens to deleted files on a computer:
Correct me if I am wrong here, but when you delete something from your PC, all your computer does is write over some of the binary with 0′s replacing the 1′s (or something to that effect). So when you send something to the Recycle Bin, it writes over part of the file, then when you delete the file from the Recycle Bin, it writes more?
Just how does the whole file deletion and Recycle Bin process work?
The Answer
SuperUser contributors Boann and Mary Biggs have the answer for us. First up, Boann:
Neither operation writes over the file. Moving a file to the Recycle Bin does just that, moves the file. Its contents are left completely intact.
Deleting a file from the Recycle Bin (or deleting it directly using Shift+Delete) removes the file name entry from the folder. The part of the disk previously occupied by the file is not modified or overwritten and still contains the file data, but that data is no longer linked to a file name. That spot on the disk is recorded as “free” however, so future writes to the disk can reuse that space, and if you keep using the disk, the space will almost certainly be overwritten eventually.
In a case where you need to prevent recovery of deleted data, special tools exist to overwrite the data securely. That is not done by default because it is slow and increases wear on the disk.
Followed by the answer from Mary Biggs:
A file is in two parts:
- A directory entry which records the file name and also contains a list of the blocks on disk which contain the data contents of the file. The operating system then “knows” that these blocks are in use.
- The actual blocks which contain the data contents of the file.
When a file is deleted:
- The list of blocks in the directory entry are marked as “free” and returned to the operating system. The directory entry is deleted, so the file “disappears” from the file system.
- The actual blocks are not touched, so the data contents of the file remain untouched until some other new file overwrites them. This is the reason that file recovery software can often rebuild deleted files (but only if it is used soon after deletion).
Have something to add to the explanation? Sound off in the comments. Want to read more answers from other tech-savvy Stack Exchange users? Check out the full discussion thread here.
No comments:
Post a Comment