When deleting a file, the system only makes a deletion mark on this file's directory entry, marking clusters it covers in FAT as "empty"; clusters in DATA remains original file's contents. When writing in data again, the original file content might be covered by new information.
There is a Recycle Bin in Windows, its principle of operation is:
The recycling bin is only some space on the hard disk; the Windows system automatically establishes a folder "RECYCLED" (under root directory of each disk partition) with hiding attribute to save temporarily deleted files. Only when deleting or executing "Clear" command, these files then can be completely deleted (as to operating system). As "the recycling bin" we see on the desktop, it is only a shortcut. Then we will introduce fast deletion and complete deletion separately.
Fast deletion of files is just to put them into Recycle Bin. In this situation, the data can be recovered.
Comparing the changes of FDT, FAT and DATA between before and after deletion, we can find the rules.
FDT before deleting "test1.txt":
FAT before deletion:
Attention: the first clusters number of the file is "000C", i.e. 12. The offset of the cluster record in FAT is "0184800", whose content is "0D 00 00 00"
FDT after deletion:
From two charts we can see, after deleting"test1.txt", the first byte of registration entry is changed to "E5H", other bytes remain the same. So are long filenames. "E5H" represents that this file has been deleted. For operation system, it no longer exists. When users request the file again, operation system will tell that this file does not exist.
FAT after deletion:
From the comparison, it makes no difference in FAT: the file still takes 10 continuous clusters. Obviously, the space the file takes is not released actually. Data still exist in DATA region indeed.
As for DATA, it is in the same situation. Now if users write in new data, when system detects that the clusters are still in use, it will use other blank cluster and DATA space. By this way, fast deleted files will not be destroyed by new data.
To complete delete "test1.txt" and compare the changes of FDT, FAT, DATA between before and after deletion:
1. FDT is the same as that of fast deletion.
2. Before complete deletion, the content of FAT is:
From the comparison we can see, the registration entry of the file in FAT has been reset, being marked as "empty". Now, if the user writes in new file to the partition, it is probable to cover the released empty cluster, thus covering the space ever used by the two files.
3. After complete deletion, there is no change in DATA sectors at all. However, data in DATA region is explained by FDT and FAT. If FDT and FAT marked the DATA as "unused", system will certainly consider it as "empty" space and will write in new information at any time. Thus, the room is still released. This is different with fast deletion.
Copyright © 2005-2013 CHENGDU Yiwo® Tech Development Co., Ltd. ALL RIGHTS RESERVED.