Into the Trash Bin
When it comes to
removing unwanted files, each of the major operating
systems has some sort of “trash” bin. This is a
staging area where your files when you first hit
“delete.” In Linux, it’s usually called the Trash Bin.
For Mac OS X, it’s simply the Trash. And for Windows,
it’s the Recycle Bin.
Just like the recycle
bin in your kitchen, the stuff you toss in your
computer’s Recycle Bin doesn’t disappear immediately.
Until it fills up and gets emptied, you can still go
in and easily pick your stuff out, pretty much intact.
When you do end up “taking out the trash,” recovering
your stuff becomes more difficult. But it’s still
possible.
Files get purged from
the Recycle Bin in one of two ways: when it gets full,
the system will start removing them (i.e.
“permanently” deleting them) on a first in, first out
basis. Or, you can choose to manually empty the
Recycle Bin to free up disk space. When this happens,
you can no longer restore your file simply by opening
your Recycle Bin, right-clicking the file and clicking
Restore.
|
Beyond the Trash Bin
So, what happens when
a file gets emptied from the Recycle Bin? With a few
rare exceptions, your file does not instantly cease to
exist. Instead, the system simply changes a bit in the
file allocation table that marks the space occupied by
that file as “free.” True to the Recycle Bin’s name,
the bits and bytes that make up your deleted file are
eventually reused to store other files. But this
doesn’t happen until the space is actually needed.
Until your file is overwritten by new data, it’s still
sitting there on your disk somewhere, wholly intact.
The only difference is that the file allocation table
is no longer keeping track of it.
|
Undeleting a File
Considering the above,
you’ve probably guessed that it’s not a good idea to
start writing new files to your disk if you hope to recover
a recently deleted file. The sooner you attempt
a file recovery, the better your chances. On the other
hand, if you wipe a disk and then fill it to capacity
with something else, then you can be almost certain
that all traces of the old file are gone. But if the
disk or partition is very large and you’ve been
conscientious about not writing any new data to it,
getting that deleted file back is fairly easy.
The only challenge to
recovering a deleted file is finding it. Remember: the
file system is no longer keeping track of it. But if
you were to track it down, you could flip that “free
space” switch back and have the file restored in its
entirety. In this way, you’re not really “undeleting”
the file. You’re just telling the system, “never mind,
don’t overwrite this, and start keeping track of it
again.” It’s a little bit like chaining yourself to a
bulldozer to stop a condemned building from being
demolished (though admittedly not quite as dramatic).
Undelete utilities
and file recovery software can help with this task.
These tools scan a hard drive for patterns that are
recognizable as known file types. These patterns are
often referred to as file signatures. Similar to an
archaeologist uncovering a femur and then being able
to reconstruct or locate the rest of the skeleton, an
undelete utility can find the header of a known file
type and then piece together the rest of your file
from there. Parts of the document, photo, or file can
be recovered even if other parts have been lost. In
some cases, these missing parts can be repaired. If
the physical disk has been damaged or corrupted, you
can save the recovered file to another disk.
|
