1

EDIT: So the question is Does Windows free up the disk space used by a file, is that data marked as deleted when it is moved to recycle bin upon deletion, or is it's pathname simply changed to recycle bin or to another folder(maybe a temp folder for Undo operations), and that data not marked as deleted until permenent?

Hello everyone, think I've found a solution here https://whereismydata.wordpress.com/2009/05/02/forensics-what-happens-when-files-are-deleted/

I know this is pretty specific to me

Basically I deleted a file and wanted to press Ctrl+z to undo that operation, this was not possible because I lost the undo button in File Explorer and Ctrl+Z.

The file is in Recycle Bin, but I want to make sure restoring that file is doing the same thing as Ctrl+z like I have tried to explain below. I mean if I left the data of the file while it still is in recycle bin Ctrl+z would be writing new data to restore that file

So I wanted to understand the process of Undo.

The research I did was read up on File systems, FAT, but I did not read up more on NTFS which I am using, I have a hdd rather than Solid state so I read about how data is stored as the polarity of a magnet 1 for a on bit or 0 for off. I looked into how Recovery software works, it will preserve the ones and zeroes of a file but not necessarily at the original location on disk so it preserves a copy of the file not necessarily the bits at their original locations, for linear addressing systems, this is relevent because if Undo/Delete does preserve bits at their original addresses recycle bin or temp preserves the original bits rather than copies of those bits.

When a file is deleted with del key, is a copy of that file made anywhere on hard disk, or is it only moved to recycle bin? I understand traces of the file may be left but does windows do anything else with that file?

user10502023
  • 19
  • 1
    The file is left where it is, windows marks the file as deleted so the disk space can be used for other files at a later date. until that space where the file is, is overwritten with other files, it can be recovered easily. – Moab Jan 30 '19 at 04:04
  • that would mean the file in the recycle bin is actually a copy, not a moved file, are you sure? and is this true for NTFS – user10502023 Jan 30 '19 at 04:11
  • 3
    If we knew what you were concerned about, what you were trying to figure out, we might be able to get you a better answer. Otherwise, Moab is right and that's about all there is to say on the subject – music2myear Jan 30 '19 at 04:11
  • good to have someone else back that up thanks, I was thinking maybe a clipboard was used and trying to understand the undo process – user10502023 Jan 30 '19 at 04:14
  • I believe however a file is only marked as deleted after removed from recycle bin, is this true? – user10502023 Jan 30 '19 at 04:17
  • Is the file moved to recycle bin, meaning it's pathname changed, or are the contents actually copied to a different address on hard disk as well as to the $recycle folder? – user10502023 Jan 30 '19 at 04:39
  • Please focus on the questions from music2myear and try to give more useful information. Currently we don't understand your problem therefore can't give a good answer. E.g. "Is the file moved to recycle bin, meaning it's pathname changed" why that to parts would be related? Please edit your question instead of answering in comments. – Máté Juhász Jan 30 '19 at 05:01

1 Answers1

1

Depending on how you deleted the files. There are two common delete functions (Delete and Shift+Delete) each of these functions have a different process of deleting files and each have different recovery methods.

Delete

  • Not Permanent until files deleted from the Recycling Bin
  • Process: Deletes the file by moving the file to the Recycling Bin
  • Recovery Method: Restore the files from the Recycling Bin

Shift+Delete (Permanent)

  • Process: Permanently deletes the file by basically bypassing the Recycling Bin
  • Recovery Method: Using a recovery program to recover only if the data has not been overwritten.

There is a third way of deleting a file permanently referred to as zero filling which is a low-level format that just overwrites the data with zeroes.

The Recycle Bin is basically one bin with many folders, going into your Recycle Bin properties you can see almost all your drives have a recycle bin location of their own with their own maximum size settings.

So your files do move to a different folder.

angelofdev
  • 1,156
  • Appreciate the answer, seems like windows does only move it to recycle bin and not really do anything else besides record the transaction – user10502023 Jan 30 '19 at 04:47
  • So a deleted file will exist only in the recycle bin and at it's original location on disk in Windows 10, not in another folder? – user10502023 Jan 30 '19 at 05:35
  • 2
    The file gets moved to the specified Recycle Bin folder of the drive. The Recycle Bin folder is a system file so it will stay hidden even when you try to show 'Hidden Folders', you can still show hidden system folders. – angelofdev Jan 30 '19 at 05:38
  • I know it gets moved(or literally copied not sure) to the recycle bin, so I'm going to assume if I scanned my system, the file would not exist elswhere taking up space. – user10502023 Jan 30 '19 at 05:43
  • That's really what I'm wondering?, thanks for the replies – user10502023 Jan 30 '19 at 05:50
  • If the file is not in some clipboard or temp directory, then Ctrl+z moves the file from recycle bin back to where it was which is why I asked the question at all, trying to understand Undo – user10502023 Jan 30 '19 at 06:44
  • @user10502023 might be worthwhile to edit your question with these new added information you have been providing in the comments for this issue. The overall quality of your question ultimately determines the overall quality of answers you receive. Have a look at the asking a question page for more tips on how to ask the best possible question for your issue. – angelofdev Jan 30 '19 at 06:54
  • Cheers, will Update – user10502023 Jan 30 '19 at 07:12