Where does the deleted files go? How they are recovered back? :The complete file deletion logic

Consider a situation. You have a file, video or audio. You are bored of that file and you delete it to save some space on your device. Hurray, the file is deleted successfully. But, its actually not. Here's how.


Its a common question in most of the minds that "where does the deleted file really go?". Today I'm going to give you some idea of what will actually happen after a deletion.


Step 1. Simple deletion
If a file is selected and 'delete' button is pressed, that file is simply moved into some location in your PC. References to that file in your PC still exists. The same can be seen in The Recycle bin. If you had deleted any file by mistake, you can go to recycle bin and simply 'restore' the file. So simply pressing 'delete' may make you feel that file is deleted, but its still in recycle bin.

Step 2. Complete deletion.
Now if you feel that you permanently don't want the file. In this case you can 'empty the recycle bin'. The file is so called 'permanently' deleted. and you can see the freed up space on your disk. Now the question is, where did it go?. "Did it escape from hard disk port?", "Did it dissolve?", "Did it evaporate?". Nope. Its still in the same place where it was before. Only thing is All the references which were pointing to that file are deleted and freed up so that those memory locations can be refereed to by some other file. Which means, until you fill in any other file in that freed up space, the deleted file is still there. Only thing is that there is no one left to refer to that file. Its simply a bunch of 'orphan data' now. It is deleted only when there comes any new data in that free space.

The file deletion logic.
Windows uses Master file table(MFT) as an index to the files it stores on the hard disk drives.When you permanently delete a file(shift+del method), it is easier for windows to mark the file's MFT record as 'deleted' instead of overwriting the real file itself with null value. so the file is simply left in the drive but it doesn't have any reference in MFT table.

Then the question is "Can we recover those orphan data?". Answer is Yes. Next question will obviously be "How? When there are no references left to those orphan data?".

Here's how!
There are some softwares for windows platform to recover permanently deleted files from the disk drives.  (Example: Recuva)

When you delete a file, windows doesn't overwrite the MFT entry with 0's until it needs to reuse the space. It simply marks the entry pf MFT record of that file as 'deleted'.  these softwares scan for MFT entries marked as 'deleted'. Since MFT entries for deleted files is still not overwritten, it contains the information of the file (including size of file, and where it is stored in hard drive), these softwares list such files and help you recover them by unmarking them from label 'deleted'.
There are also deep scan mechanisms which search each block of data in hard disk for beginning of a file(which contains info about type and size of the file) and recover the same. But only thing is recovery can be done if file is 'not fragmented' or not stored in parts.

As a tip for better recovery, It is better to use these softwares as soon as you realize that the file has been deleted. Because windows, when in need to create new files, will delete the MFT entries marked with 'deleted' to make room for new data. Which may result in permanent deletion of data.


I hope the doubts are cleared by now. If you have got anymore questions, drop a comment below. I would love to make research on them and answer them. Share this with your friends and spread the knowledge.

Author : Anonymous

He is a simple passionate tech freak who himself is an engineering student at Canara Engineering college. He likes App Development, Web designing, Blogging, Youtubing, Debugging and also is a CodeGeek!

Sharing is sexy!

Related Articles