0

I know that when you delete a file, you can still recover it until such time it's overwritten and can't be recovered(I know this is a oversimplification of what actually happens).

However, is it possible to recover a file or know what file used to occupy a folder after it's been moved? What I mean is, suppose I had a document called work.doc in my Documents folder, now I move that .doc file to my portable drive. If someone else comes along, can they run a piece of software to know what file used to occupy my documents folder, and see work.doc?

I know a person can see the recently opened files from the start menu or windows explorer, but if those were cleared, or I had that feature turned off, can a piece of software know what was there? Worse, could they possibly open it?

  • I think that this is related: How to recover moved (cut) files from a disk? When files are deleted/cut from their original location, they are only marked as potential free space for writing. The files are still there until they're overwritten by something else. – flolilo Jun 27 '17 at 22:58
  • 2
    Yes, because MOVE is actually a short term for two different steps: COPY, and DELETE in most cases. File recovery programs will find files that have been moved in the same way they find files that have been deleted directly. – music2myear Jun 27 '17 at 22:59
  • I'm not sure what happens on all file systems, but on some the directory entry is flagged as free by putting a null in the first name byte, so until that entry is reused the name is recoverable, minus the first character: in your case the name would be ?ork.doc, with? an unknown character. The reuse of the space that the file occupied is independent of the reuse of the directory entry. – AFH Jun 27 '17 at 23:36

0 Answers0