What happens when file gets deleted from system?

It happens. You delete a folder or format a memory card without realizing that it contained some crucial file, photo, or document. Fortunately, there are a number of ways you can recover or “undelete” that file. However, it’s not magic and you won’t be able to recover 100% of your file 100% of the time. To understand what affects your chances for a successful file recovery and what you can do to increase those chances, it’s worthwhile to learn what happens when you delete a file. And that’s precisely what we’ll talk about in this article.

Into the Trash Bin
When it comes to removing unwanted files, each of the major operating systems has some sort of “trash” bin. This is a staging area where your files when you first hit “delete.” In Linux, it’s usually called the Trash Bin. For Mac OS X, it’s simply the Trash. And for Windows, it’s the Recycle Bin.

Just like the recycle bin in your kitchen, the stuff you toss in your computer’s Recycle Bin doesn’t disappear immediately. Until it fills up and gets emptied, you can still go in and easily pick your stuff out, pretty much intact. When you do end up “taking out the trash,” recovering your stuff becomes more difficult. But it’s still possible.

Files get purged from the Recycle Bin in one of two ways: when it gets full, the system will start removing them (i.e. “permanently” deleting them) on a first in, first out basis. Or, you can choose to manually empty the Recycle Bin to free up disk space. When this happens, you can no longer restore your file simply by opening your Recycle Bin, right-clicking the file and clicking Restore.

Beyond the Trash Bin
So, what happens when a file gets emptied from the Recycle Bin? With a few rare exceptions, your file does not instantly cease to exist. Instead, the system simply changes a bit in the file allocation table that marks the space occupied by that file as “free.” True to the Recycle Bin’s name, the bits and bytes that make up your deleted file are eventually reused to store other files. But this doesn’t happen until the space is actually needed. Until your file is overwritten by new data, it’s still sitting there on your disk somewhere, wholly intact. The only difference is that the file allocation table is no longer keeping track of it.

Undeleting a File
Considering the above, you’ve probably guessed that it’s not a good idea to start writing new files to your disk if you hope torecover a recently deleted file. The sooner you attempt a file recovery, the better your chances. On the other hand, if you wipe a disk and then fill it to capacity with something else, then you can be almost certain that all traces of the old file are gone. But if the disk or partition is very large and you’ve been conscientious about not writing any new data to it, getting that deleted file back is fairly easy.

The only challenge to recovering a deleted file is finding it. Remember: the file system is no longer keeping track of it. But if you were to track it down, you could flip that “free space” switch back and have the file restored in its entirety. In this way, you’re not really “undeleting” the file. You’re just telling the system, “never mind, don’t overwrite this, and start keeping track of it again.” It’s a little bit like chaining yourself to a bulldozer to stop a condemned building from being demolished (though admittedly not quite as dramatic).

Undelete utilities and file recovery software can help with this task. These tools scan a hard drive for patterns that are recognizable as known file types. These patterns are often referred to as file signatures. Similar to an archaeologist uncovering a femur and then being able to reconstruct or locate the rest of the skeleton, an undelete utility can find the header of a known file type and then piece together the rest of your file from there. Parts of the document, photo, or file can be recovered even if other parts have been lost. In some cases, these missing parts can be repaired. If the physical disk has been damaged or corrupted, you can save the recovered file to another disk.

Summary
That’s file recovery in a nutshell. This has been a very high level discussion of the overall process, but it should help you understand how file recovery works and why certain approaches are better than others. You basically have two chances to undelete a file: (1) by restoring it from the Recycle Bin or Trash Bin and (2) by recovering it before it’s overwritten by new data. Keep this in mind for the next time you accidentally delete an important file.