Search This Blog

Friday, March 19, 2010

How can deleted computer files be retrieved at a later date?

Clay Shields, professor of computer science at Georgetown University,offers this answer:
 
              “Deleted” files can be restored because they aren’t really gone—at least not right away. This is because it is faster and more efficient for computers to overwrite data only when necessary, when no other space is available to write new data.

                A computer stores information in chunks called sectors. A file may be written across several sectors and might be scattered around the disk. The operating system keeps an index of which sectors belong to which files and a directory that maps the file names to the index entries.

                When a user deletes a file, its directory entry is either removed or labeled as deleted. A deleted file can thus be salvaged if the index information and sectors have not yet been reused.

                Such recovery is easy in operating systems that simply mark directory entries as deleted. A program scans the directory for deleted entries and presents a menu of files to recover. In other types of systems, recovery is more complicated. The directory entries may be lost, making it harder to find the file. The recovery program must look through all the index information and piece together files from various sectors. Because sectors may have been reused, only parts of the file may be accessible.

No comments:

Post a Comment