Tilted Forum Project Discussion Community - View Single Post

Silvy · 08-09-2003, 05:48 PM

Depending on the filesystem your computer uses different things happen..
But usually it works like this:

Filenames are saved all bunched up together in one area of the disk. That is called the FAT (File Allocation Table). Next to every filename in the FAT is an 'address' of the contents of that file...

So if you draw the layout of the disk, you'd have many names in one section, pointing to all directions at different areas of the disk.

Because the filename points to said location, your computer knows that space of the disk is used. When you delete your file, the computer just removes the name from the FAT. (not the pointer, see notes)

That way the location is no longer being pointed to, and the space is thereby free.
(while the actual contents are still there)

---- Notes:
That's how undelete works: it puts the filename right back at the pointer.

Not all filesystems behave this way. Some completely destroy any record of that file (making undelete impossible as the system won't know where the file started). (specialized software can still guess contents of files....)
Other filesystems completely overwrite even the contents of the file making data recovery (near-) impossible.

I'm not sure here: but DOS did not actually remove the filename either... It just emptied the first character of the filename. Then the system would know that the space taken up by the file was available, yet if you wanted to undelete you would only have to guess the first character of the filename.

08-09-2003, 05:48 PM	#2 (permalink)
Silvy paranoid Location: The Netherlands	Depending on the filesystem your computer uses different things happen.. But usually it works like this: Filenames are saved all bunched up together in one area of the disk. That is called the FAT (File Allocation Table). Next to every filename in the FAT is an 'address' of the contents of that file... So if you draw the layout of the disk, you'd have many names in one section, pointing to all directions at different areas of the disk. Because the filename points to said location, your computer knows that space of the disk is used. When you delete your file, the computer just removes the name from the FAT. (not the pointer, see notes) That way the location is no longer being pointed to, and the space is thereby free. (while the actual contents are still there) ---- Notes: That's how undelete works: it puts the filename right back at the pointer. Not all filesystems behave this way. Some completely destroy any record of that file (making undelete impossible as the system won't know where the file started). (specialized software can still guess contents of files....) Other filesystems completely overwrite even the contents of the file making data recovery (near-) impossible. I'm not sure here: but DOS did not actually remove the filename either... It just emptied the first character of the filename. Then the system would know that the space taken up by the file was available, yet if you wanted to undelete you would only have to guess the first character of the filename. __________________ "Do not kill. Do not rape. Do not steal. These are principles which every man of every faith can embrace. " - Murphy MacManus (Boondock Saints) Last edited by Silvy; 08-09-2003 at 05:50 PM..