What does delete really do?

[Guest Dave]

Not sure I'm on the right list, but ---

 

Let's say I have a rather large Win XP document, no longer needed, so I just

'delete' it. It goes into my Recycle Bin, but let's also then empty it as

well.

 

As I understand it, the document is still on my HD someplace (maybe more

than one place?), however, by 'deleting' it all that really happened was

some of the first index bytes of the appropriate cylinder/track/sector were

changed to indicate that particular c/t/s was now available for overwriting.

As long as no new material is saved to the HD which overwrites this c/t/s,

then, the document is still recoverable by undelete and/or related

techniques.

 

Now to my question. Let's say I delete the document by deleting the entire

contents of the document (while it's still open), then close the now-empty

document, saving it under the same name. The question is, is the entire

(original) document still recoverable? By any technique?

 

TIA

Dave

[Guest db ´¯`·.. >]

Re: What does delete really do?

 

yes,

 

keep in mind

that one file may actually

be in fragments through

out your disk.

 

the larger the file the

more fragments exist.

 

so if your 20 megabyte

file was then saved

into a 1k file because

you remove all the

data, the other fragments

are still lingering.

 

further, if the software

has a feature that backups

files in the background,

then they too linger and

are overlooked and are

not deleted.

 

what is helpful is to

simply "scrub" the drive

on occasion.

 

--

 

db·´¯`·...¸><)))º>

 

"Dave" <djbahb@dcwis.com> wrote in message

news:%238gxr1jgIHA.1944@TK2MSFTNGP02.phx.gbl...

> Not sure I'm on the right list, but ---

>

> Let's say I have a rather large Win XP document, no longer needed, so I just

> 'delete' it. It goes into my Recycle Bin, but let's also then empty it as

> well.

>

> As I understand it, the document is still on my HD someplace (maybe more than

> one place?), however, by 'deleting' it all that really happened was some of

> the first index bytes of the appropriate cylinder/track/sector were changed to

> indicate that particular c/t/s was now available for overwriting. As long as

> no new material is saved to the HD which overwrites this c/t/s, then, the

> document is still recoverable by undelete and/or related techniques.

>

> Now to my question. Let's say I delete the document by deleting the entire

> contents of the document (while it's still open), then close the now-empty

> document, saving it under the same name. The question is, is the entire

> (original) document still recoverable? By any technique?

>

> TIA

> Dave

>

>

>

[Guest Animenia]

Re: What does delete really do?

 

 

Dave;570939 Wrote:

> Not sure I'm on the right list, but ---

>

> Let's say I have a rather large Win XP document, no longer needed, so I

> just

> 'delete' it. It goes into my Recycle Bin, but let's also then empty it

> as

> well.

>

> As I understand it, the document is still on my HD someplace (maybe

> more

> than one place?), however, by 'deleting' it all that really happened

> was

> some of the first index bytes of the appropriate cylinder/track/sector

> were

> changed to indicate that particular c/t/s was now available for

> overwriting.

> As long as no new material is saved to the HD which overwrites this

> c/t/s,

> then, the document is still recoverable by undelete and/or related

> techniques.

>

> Now to my question. Let's say I delete the document by deleting the

> entire

> contents of the document (while it's still open), then close the

> now-empty

> document, saving it under the same name. The question is, is the

> entire

> (original) document still recoverable? By any technique?

>

> TIA

> Dave

 

Sorry Dave but NO.

If the CONTENT of the dokument is deleted and you save the dokument the

content is unrecoverable.

 

However as you said first if you just delete the file itself you can

recover it.

You can recover anything deleted from your harddrive with the right

tools.

'Ibas' (http://www.ibas.com/) being one of them.

[Guest Holz]

Re: What does delete really do?

 

On Sun, 9 Mar 2008 18:29:24 -0500

"Dave" <djbahb@dcwis.com> wrote:

> Now to my question. Let's say I delete the document by deleting the

> entire contents of the document (while it's still open), then close

> the now-empty document, saving it under the same name. The question

> is, is the entire (original) document still recoverable? By any

> technique?

 

To remove deleted documents and information you can use a freeware

called sdelete (secure delete) fro http://sysinternals.com

 

 

--

Live & let live, or leave.

:-)

[Guest Onsokumaru]

Re: What does delete really do?

 

 

"Dave" <djbahb@dcwis.com> wrote in message

news:%238gxr1jgIHA.1944@TK2MSFTNGP02.phx.gbl...

> Not sure I'm on the right list, but ---

>

> Let's say I have a rather large Win XP document, no longer needed, so I

> just 'delete' it. It goes into my Recycle Bin, but let's also then empty

> it as well.

>

> As I understand it, the document is still on my HD someplace (maybe more

> than one place?), however, by 'deleting' it all that really happened was

> some of the first index bytes of the appropriate cylinder/track/sector

> were changed to indicate that particular c/t/s was now available for

> overwriting. As long as no new material is saved to the HD which

> overwrites this c/t/s, then, the document is still recoverable by undelete

> and/or related techniques.

>

> Now to my question. Let's say I delete the document by deleting the

> entire contents of the document (while it's still open), then close the

> now-empty document, saving it under the same name. The question is, is

> the entire (original) document still recoverable? By any technique?

>

> TIA

> Dave

>

>

>

 

 

That would depend on whether the OS saves the new file by overwriting any

sectors the original file occupied, or if it just saved the file elsewhere

and marked the original space as unoccupied.

 

I'm not sure of the mechanics of this aspect of file/disk management.

 

But let's say it did overwrite the same sectors used by the original. That

would mean a few KB of the original file would be gone.

 

Let's say the each block is 4 KB in size, the new blank document is likely

to be less than this, so all but 4 KB of the original document is likely to

be recoverable, (because a file can occupy no less than one sector of data.

Any unused space is known as "slack").

[Guest HeyBub]

Re: What does delete really do?

 

Animenia wrote:

> Dave;570939 Wrote:

>> Not sure I'm on the right list, but ---

>>

>> Let's say I have a rather large Win XP document, no longer needed,

>> so I just

>> 'delete' it. It goes into my Recycle Bin, but let's also then empty

>> it as

>> well.

>>

>> As I understand it, the document is still on my HD someplace (maybe

>> more

>> than one place?), however, by 'deleting' it all that really happened

>> was

>> some of the first index bytes of the appropriate

>> cylinder/track/sector were

>> changed to indicate that particular c/t/s was now available for

>> overwriting.

>> As long as no new material is saved to the HD which overwrites this

>> c/t/s,

>> then, the document is still recoverable by undelete and/or related

>> techniques.

>>

>> Now to my question. Let's say I delete the document by deleting the

>> entire

>> contents of the document (while it's still open), then close the

>> now-empty

>> document, saving it under the same name. The question is, is the

>> entire

>> (original) document still recoverable? By any technique?

>>

>> TIA

>> Dave

>

> Sorry Dave but NO.

> If the CONTENT of the dokument is deleted and you save the dokument

> the content is unrecoverable.

>

 

Not exactly the case. If the document was created in Word (and some other

programs) simply deleting the contents is but a "revision" to the document

and several generations of "revisions" may be imbedded in the .DOC file.

This feature enables the user to 'back-out' of a any number of document

modifications and return to the original or any other point in the

document's life-cycle.

 

We've all seen cases where some sensitive material is 'blacked out' and the

resulting document file distributed. Enterprising folks can erase the

'blacked-out' area to discover what the distributor hoped was hidden.

 

This technique is also available for Acrobat files and probably others.