Why The Deleted Files Can Be Recovered

We all know that when you delete a large file can be completed quickly. because it isn't really reased the data, it continues existing on your hard drive.


What happens when delete a file

When you delete a file, Windows (and other operating systems) is marks the sectors containing the file's data as available. For the system, the file no longer exists in your hard drive and the sectors containing data are considered free space.


Let's look at the following example

1. It's prepare an empty disk and create a test.txt file in the disk.


2. open the test.txt file and write some data.


3. Load the disk raw data and jump the file directory entry. The marks flag data is in the disk offset 0x3D020 position.


4. The test.txt file data is in the disk offset 0x41000 position.


5. Now ,delete the file from disk. and let check what changed in the disk.


6. Goto the 0x3D020 position in the disk. We found the 0x3D020 position data is 0x54 change to 0xE5, and othe data is not changed.


6. Goto the 0x41000 position in the disk. We found the file data is exist in the disk.