...
File Deletion
Regardless of the file system, when you delete a file, Windows doesn't remove the file at all, usually. Instead, the operating system moves the file's directory entry and information about the file's original location into a hidden folder that represents the Recycle Bin. The data clusters for the file aren't deleted or even moved. Only the location of the directory entry changes.
When the Recycle Bin fills up, the oldest files are truly deleted, and when you empty the bin, they're all deleted. Although you can bypass the Recycle Bin by holding down Shift when deleting a file, even then the file's data remains! Under FAT or FAT32, Windows marks the FAT entries for the file's clusters to indicate that they're available for reuse,
and then marks the file's directory entry as deleted by changing the first character of the filename to a special flag character.
Under NTFS, the process is similar; the file's MFT entry, directory entry, and data clusters are marked as available. The file's data remains, though, until the clusters get recycled
[overwritten] to store some other file.
...
Advanced Data Recovery
For a file that can't be recovered by ordinary undelete utilities, there are heavier-duty options available. PowerQuest's Lost & Found is designed to recover data from FAT or FAT32 partitions without even booting the operating system. Ontrack offers a free download of EasyRecovery that will recover up to five files and identify files that the full version could recover; EasyRecovery Pro adds NTFS support. If all else fails, you can contract with a data recovery service; these services can often recover data from disks that have been physically damaged by flood, fire, and so on.
Another Ontrack product, CaptureIt, can be used when a legal proceeding requires access to all the data on a particular computer. CaptureIt makes a byte-for-byte copy of the entire drive at a level below the file system. This copy can be stored on a server, digitally signed to prevent modification, and thoroughly analyzed. The computer itself can remain in service, instead of being sequestered as evidence for the duration of the proceeding.
Once the disk clusters that were occupied by a deleted file have been overwritten with new data, the file is gone forever. Or is it? In fact, the old data may still be present on the magnetic media, as a kind of wiggle in the waveforms that represent the data. Using intricate, high-tech equipment, technicians first copy the exact waveform recorded on an area of the disk, without translating the signal into bits and bytes. They then generate a perfect waveform representing the corresponding data bits, subtract the perfect waveform from the actual waveform, and amplify the differences. When successful, this process recovers the data previously stored in the specified area of the disk (Figure 4). Theoretically, you can even repeat the process, obtaining yet an earlier chunk of data. Physical limitations preclude more than seven repetitions of the recovery process. That doesn't mean you can recover seven layers of data, only that you can't recover more than seven. This level of recovery must be performed by experts, and is painstaking and expensive. In most cases, recreating the lost data from scratch is more cost-effective.
...
