File deletion technical reference
How the Recycle Bin works
Deleting a file to the Recycle Bin is the simplest type of deletion.
Sometimes a file or folder cannot be moved to the Recycle Bin, and hence cannot be recovered using the Recycle Bin.
This occurs when:
- the Recycle Bin is configured so that to remove files immediately when deleted;
- a file is too large to be placed into the Recycle Bin (larger than the maximum size of the Recycle Bin);
- a file was deleted not by Windows Explorer, but by another program that doesn't move files to the Recycle Bin;
- a file was deleted by pressing Shift+Del in Windows Explorer, thereby forcing the Recycle Bin to be bypassed;
- a file was deleted not from an internal hard drive but rather from a removable memory card, an external, or a network drive.
On top of that, the Recycle Bin has the maximum size that can be configured in the Properties of the Recycle Bin
(right-click on the Recycle Bin icon and select Properties).
Keep in mind that there is a separate Recycle Bin for each hard drive and the Recycle Bin settings (e.g., the maximum size)
can be configured separately for each drive.
As the Recycle Bin is filled, the oldest files or folders are thrown away to make room for the new ones.
Actual removal of a file in various filesystems
When files or folders are "fully" deleted, their content on the disk is not actually overwritten.
In this case the special mark is set which means this file or folder is not needed any longer and its data on the disk as
well as the description in the filesystem tables can be reused for another object.
Nevertheless, the reuse only occurs when the disk space is really required.
Depending on the filesystem type, the actual removal of a file is implemented in different ways:
NTFS: if nothing has been written on the disk after deleting the file, the file data is intact;
exFAT: if the file is not fragmented, data is intact.
Otherwise the information about the location of file fragments is lost, same as on the FAT filesystem.
FAT: information about the location of file fragments is lost immediately.
If you are lucky, and the file was not fragmented (it means that the file data was located on the disk contiguously),
then the information about the location of file fragments is not required and therefore the file can be recovered in full.
Generally, the fragmented files cannot be recovered; at best, separate fragments can be obtained.
The more the disk fills up, and the more you change the files, the greater the possibility that the files are fragmented.
On top of that, FAT can lose the first letter of the file name.
During recovery, ReclaiMe File Recovery replaces the missing first letter
with the underscore character.
HFS and HFS+:
HFS stores file information (both name and the file data location) in a balanced tree structure.
Sometimes when the file is deleted, the entire tree has to be "rebalanced", resulting in massive changes to the on-disk filesystem structures.
The undelete results on the HFS series filesystems are significantly less predictable than on Windows filesystems because of this balanced tree feature.
So, in each case you need to try to actually recover the file to see if it is possible or not.
UFS (Apple implementation in Mac OS X):
Because of the way the files are deleted in the Mac OS X implementation of the UFS filesystem,
only a raw undelete (by searching the entire disk for file fragments) is possible.
The file data location information is lost immediately once the file is deleted.
The truly irreversible removal
The truly irreversible file deletion (also known as "secure erase" or "wiping")
requires special software that overwrites the content of the files with zeros or random sequences.
In computers, the ovewritten data is irrecoverable.
Still have questions?