Computers File Undelete Utility

Discussion in 'Computers' started by Reisti Skalchaste, Dec 7, 2005.

  1. Reisti Skalchaste

    Reisti Skalchaste New Member

    Joined:
    Jun 14, 2004
    Messages:
    3,554
    Likes Received:
    137
    Neph asked me to post this, hope that's alright.

    Anyway...

    This program works because in Windows, no file is ever really deleted (unless you do a format). Deleting a file only deletes the thing that references the data on the drive- essentially it makes it so your computer doesn't know how to find the data.

    This is why the police will still know you had that kiddie porn even if you deleted it before they catch you. :p
     
    #1
  2. Superfly

    Superfly Active Member

    Joined:
    Feb 23, 2003
    Messages:
    612
    Likes Received:
    27
    Interesting..
    I'll have to try that out when I get home, because I'm in school on my iBook now.
    Makes me wonder if there isn't a way to permanently delete the files anyway. I looked up a bit and found Chaos Shredder, but that thing overwrites those "backup" files with junk files. Sounds suspicious..
     
    #2
  3. Zanza

    Zanza .Net-ing & PHP-ing~*
    Staff Member

    Joined:
    Jul 16, 2001
    Messages:
    4,652
    Likes Received:
    117
    Interesting.. gonna give it a try when I d/l the file.

    And I guess windows only deletes the pointer rather than the file itself.. this is somehow useful? No wonder why I think my laptop needs a format.. it feels like its heavy..
     
    #3
  4. BakaMattSu

    BakaMattSu ^__^
    Staff Member

    Joined:
    Feb 16, 2001
    Messages:
    4,871
    Likes Received:
    122
    Close, not an entirely true statement, but close.

    The FAT32/NTFS file systems that Windows runs on work so that when you delete a file, the system marks it as data that can be overriden by setting a signature byte. That means the data is in fact there, but it's flagged as expendable. The next time a file is saved on your machine, that old data is fair game for being overwritten. You can lose the data without formatting.

    That is why it is crucial to recover accidental loss as soon as you can - there are no guarantees with undeletion.

    That file system design is also why Windows systems are so prone to disk fragmentation (which is when files aren't continguously written to the drive, which slows down access time on such files) - continuously downloading new files after deleting old ones will result in small fragments of the drive here and there.
     
    #4
  5. Zanza

    Zanza .Net-ing & PHP-ing~*
    Staff Member

    Joined:
    Jul 16, 2001
    Messages:
    4,652
    Likes Received:
    117
    So, in another words, if we undelete the old files, the new ones -that overwritten (cover? :p) the old ones- will be lost?
     
    #5
  6. Reisti Skalchaste

    Reisti Skalchaste New Member

    Joined:
    Jun 14, 2004
    Messages:
    3,554
    Likes Received:
    137
    My error. I read it somewhere and didn't remember all the details. :sweat2:

    I know though, that if the data is overwritten, then it is lost. Think of it like pencil impressions on a page. After you erase the pencil, if you were pressing down hard when you wrote it, you can still kinda see what was there, because of the indentations in the paper. If you really had to, you could carefully go over it and rewrite the whole thing.

    But if you write over it, then the indentations are mixed up, covered by the new text and impossible to read.

    Does that make any sense or am I babbling? :p
     
    #6
  7. wertitis

    wertitis Proud Mary keep on burnin'

    Joined:
    Oct 18, 2004
    Messages:
    1,792
    Likes Received:
    79
    I could have sworn I mentioned that this paralleled an older thread...

    Regardless, no, that statement is incorrect.

    Let my try to explain it a little more simply. Let's say that there were two people in your HDD along with a million chalk boards. Ok?

    One person is the 'boss' and he has in his hands a sheet of paper that tells him which chalkboards have pertinent information on them, and which ones don't. All he does is sit in his chair and tell the second guy what to do.

    The second guy is a runner who dashes between all the chalkboards and writes whatever the boss tells him to write on which ever chalkboard. The Boss says write THIS on THAT chalkboard and the runner goes out and mindlessly writes over whatever was on the chalkboard before with the new information he was told to place down.

    Let's say you have information (A file) called "Zanza loves Bleach" and it takes three chalkboards to write this information down. The boss looks at his sheet and sees that three chalkboards don't have anything important on them so he tells his runner to go out, find those chalkboards, and write down the information for "Zanza Loves Bleach".

    The next day you want to get rid of "Zanza Loves Bleach" so you tell the Boss "Get rid of that information; Delete it." So the Boss looks at his sheet and adds a tac mark next to the chalkboards that have "Zanza Loves Bleach" on them, marking them as "open spaces".

    For most people this is deletion. If you want that file back and you ask the boss "Where's Zanza Loves Bleach?" he wont look at those chalkboards he labled with a tac mark because that's data you told him to disregard- Those are chalkboards you told him he could write over at any time. The information is still on the chalkboards themselves, but because it's marked on his sheet he simply ignores them whenever you search for it.

    Now there are two types of undelete programs-

    One is a program that acts as a third person who runs up and down the rows of chalkboards looking for the ones that have the information for "Zanza Loves Bleach" and tells the Boss where their locations are. The boss re-writes the info down on his sheet and you "undeleted" "Zanza Loves Bleach".

    The other, more common one, simply tells the boss to go ahead erase those tac marks and make the information on those chalkboards "important" again.

    Good so far?

    Ok, Let's say that you don't do that. Before you use your "Un-delete program" you tell the boss to delete "Zanza Loves Bleach" and write down "Zanza Loves Chad". The boss looks at his sheet, sees the three chalkboards that have "Zanza Loves Bleach" are 'open for use' (because you told him to 'delete' "Zanza Loves Bleach") and sends his runner out to erase "Zanza Loves Bleach" on those boards and write over "Zanza Loves Chad". The next day you decide that "Zanza Loves Chad" is all fine and dandy, but you'd like to have "Zanza Loves Bleach" back. So you get your undelete program and send him on his way. Search as he might he cannot, for the life of him, find "Zanza Loves Bleach" on any of the "open" chalkboards.

    What's more, is the second kind of un-delete program is equally helpless because the chalkboards containing "Zanza Loves Bleach" have already been overwritten so there's no "tac marks" for the boss to erase anymore. You've already lost "Zanza Loves Bleach" and there's no way to get it back.

    In both cases you're out of luck because the runner erased "Zanza Loves Bleach" and wrote "Zanza Loves Chad" over it on the chalkboards themselves.

    That's why you need to hurry up and try to undelete programs as soon as you realize your mistake because once the little runner in your HDD writes over your files you're out of luck and can no longer un-delete them.

    So to answer your question, No. The new files that overwrote your old files will not be overwritten by the old files if you undelete. The old files are gone for good at this point. Your new files are safe and sound unless you chose to delete them as well.


    I hope all that made sense to someone other than myself.

    ~W
     
    #7
    1 person likes this.
  8. SaberJ2X

    SaberJ2X Moderator
    Staff Member

    Joined:
    Aug 29, 2002
    Messages:
    2,079
    Likes Received:
    114
    file commander boot cd
     
    #8
  9. Teddz

    Teddz Sexy Swedish Love ♥

    Joined:
    Dec 8, 2002
    Messages:
    3,501
    Likes Received:
    136
    Recover it all.

    Best recover program ever, actually saved me from my partition crash :p

    - Teddz
     
    #9

Share This Page