Many people believe that when files are deleted, the system will clear all the content of the deleted files, that is to write "0" to corresponding blocks of the disk. The actual situation is different. Think about that, how much time we shall take to delete a large file (for example several hundred MB files)! The system working efficiency will turn to be very low.
In fact, when deleting files, system just makes a deletion mark on this file and marks the the clusters they cover in FAT table as "empty", while in the DATA region clusters still preserved the original file content. Certainly, under operating system, you cannot see the files with deletion marks without the help of special software or program. For the operating system, the files are "truly" deleted! And when writing data again to the disk, the system probably may cover these original files, that are to write new information to cover the blocks of deleted files.
From Windows 95 operating systems, there is a Recycle Bin in the Windows system. In fact, the Recycle Bin is only some space on the hard disk; the Windows system automatically establishes a folder "RECYCLED" (under root directory of disk's each partition) with hiding attribute to save temporarily deleted files. Only when more deleting or executing "Clear" command, these files then can be completely deleted (as to operating system). As "Recycle Bin" we see on the desktop, it is only a shortcut. Then we will introduce temporary deletion and complete deletion separately.
In FAT16 (Windows 98), we simply delete some files, that is put it to the Recycle Bin, in this situation files are recoverable. So, let's have a look at that for FDT, FAT and the DATA, what is the difference between before and after deletion.
After deleting long file~.txt, the FDT is as the following chart:
After deleting the long file~. txt, in the file directory, only the first byte is changed into "E5H", the others are not. And so is the long filename, all the first byte of registration entries that describe long file name are changed into "E5H". This "E5H" means this file was deleted. The operating system would consider it already "has not existed". When the user requests this file, the operating system will tell that this file does not exist.
And the corresponding FAT would not be changed. In fact, after the file is deleted, the space the file covers is not really "released", it also exists in DATA. Let's have a look at the corresponding DATA before and after deletion:
In addition, the recycling bin is also changed. Because we do not delete any file or directory in the logical disk, there is no sub-directory of Recycle Bin on the partition. When deleting this file, the system automatically establishes Recycle Bin sub-directory, which FDT content is as following chart:
When file registration entry of the deleted file in FDT has been marked with deletion (first letter change to E5H), in Recycle Bin. It also makes an indicator that pointer to the first cluster of the deleted file. Of course, only these information are not enough. When we restore the deleted files to their original place, we can see much more information. Or you cannot make choice when restoring.
The information is recorded in file INFO2, the reader who is interested may further analyze. If it is complete deletion, there will be no file INFO2 in system. Then what about after restoring?
After files in Recycle Bin are restored, the file register entries are correspondingly changed as "E5H" (deletion status), and files in FDT are returned to original status.
We can understand this deletion process like this: when the system is deleting files, it moves the files to the Recycle Bin folder; then it overwrites the original FDT registration to "deletion" as well as establishes a file similar to the log in the recycling bin folder, recording related operation information; By this way, we may know some necessary information when we refer to the Recycle Bin.