How your files are deleted and recovered

Have you ever wondered what happened when you delete a file? Yes it goes to the recycle bin. But what happens when you delete it from the recycle bin? It gets deleted from your computer. Sometimes you delete a file by mistake and you scour the web for file recovery applications to bring it back. And they do a good job in recovering your file. So what really happened when you deleted it?

The process is a little different depending on your operating system. But at the end of the day, nothing really happens to the file in question.

What is a file anyway? A file is a series (not necessarily consecutive) of zeros and ones defined in a container that when read with the correct program contains data. The container itself is virtual. In new Windows machine, the NTFS (windows file system) define those container in the Master File Table.

This is where all files metadata such as, file name, file size, parent folder, location in the hard drive (where the zeros and ones are) and various other information about it can be stored.

In Linux based system, the most popular file systems are the of the ext family. In a similar fashion it supports attributes where file metadata can be stored.

So in general, a file is simply a series of ones and zeros. I say in general because some files can have metadata directly embedded in its first bytes, but let's keep it simple for now.

Now we have an idea what a file is. So what happens when it is deleted? The file is moved to a special folder, the recycle bin in Windows, or .Trash folder in Linux systems. Note that moving the file to trash simply means adding an entry in the metadata. The file itself is not modified or moved.

“ A file is metadata + content. Content is not changed on deletion. ”

If you decide to empty the trash, all the computer will do is mark your file as deleted. The entry in the MFT or in the ext attributes is discarded. Now there is nothing pointing to this part of the hard drive. This section of the hard drive is now made available to the rest of the system to be overwritten by another file.

Technically your file is still there, but it is invisible.

When you use one of those file recovery applications, they scan the free part of your hard drive and see if they can detect any file signature. For example, a JPEG has a signature, it has some of the image metadata directly in the inside itself. So based on that data, the program can attempt to recover the file. The same thing can be done for other file types.

“ The Recycle Bin is a regular folder that the Operating System treat in a special way. ”

One common problem is that most people only download a file recovery application after they have lost their files. Do you see the problem? By downloading and installing an application it is very likely that it will install itself on the newly made available space. It is better to have the program before hand but then again, why would you get the application before needing it?

Recover your deleted files.

So what do you do if you deleted a file by mistake? First of all, before you get to this kind of problem you want to use one of those online storage services. Believe it or not but the free tier (3 to 5 Gigabytes) is plenty for most your needs. You have Google Drive, Skydrive, Dropbox. Any of them will do. Most have a backup strategy where you can recover earlier versions of your files even when you delete it.

But let's say you delete an important work file and there is no way you can spend time recreating it. If losing is not an option, then I suggest you shutdown your machine right away. If you are at work, after your machine is off, notify the IT department.

Otherwise, I suggest you use a second machine. On the second machine, you can install the program to recover your file and then scan your hard drive that contains the deleted file. You have more chances to recover it like that.

If you managed to shutdown your machine before you made any modifications, it is very likely to recover a lost file, because like you saw above, the file content is not modified in anyway when deleted.

Note however, that there are some programs that securely delete your file from the disk. What they do is when the file is deleted, they take the blocks of content where the file uses to be and overwrite it with random zeros and ones. This way nothing can be recovered. But then again, you will most likely not "securely" delete a file you need by mistake, because it requires more steps.

---

There you go, in a nutshell, you now know what a file actually is, and what happens to it when it is deleted. And you also have an idea of how to increase your chances to be able to recover your files.

“ The reason it takes only a few milliseconds to delete an extremely large file is because all your system has to do is mark the header of the file as deleted. ”

---