How does the OS know a file is safe to overright? Can't find much info\links, i assume it gets flagged at the beginning, so can anyone be more specific?

That dont seem right either, how wpuld it flag data on a drive? somene told me the first character gets changed but i dont think so.

how wpuld it flag data on a drive? somene told me the first character gets changed but i dont think so.

That's what the delete button/recycle bin does John, flags the clusters concerned where the data is stored as being available for overwriting. Basically it just a very simple encryption process. That's what happens when you press delete - it encrypts the data making up the file.

Whenever a file is stored on a hard disk, it's not necessarily all stored together - it can be split into X number of pieces and stored randomly wherever there happens to be space available to store it. Each fragment is tagged as being linked. When you open a file the OS reads the first part, reads all the others and then rewrites the entire lot on a clear space of hard drive which is what "opens" whenever you open a file.

You always open a copy. Any permanent saved changes made get written to the original data clusters.

The reason your OS can do this is because the data is tagged in this way and the OS can read the instructions.

When you delete a file, the OS basically encrypts it so as it can no longer be read by the OS and therefore can't be opened. If read in such a way the OS assumes these clusters are available for data storage and so will write to them.

Retrieval software uses the OS's encryption sequence and decrypts anything it finds which uses it - there by making so called "deleted" data recoverable. Providing enough of the clusters where the original data was stored haven't been over written too, a good portion of the data apparently lost can be retrieved.

How does the OS know a file is safe to overright?
when you delete it frome the recycle bin


somene told me the first character gets changed but i dont think so.
at one time that's what happened, the first character was changed to an underscore.

This data recovery site (http://www.aumha.org/a/recover.php) says it flags the data by changing the first character.

My understanding of it has always been that hard drives have a 'table' that tells it the location of of the stored data, and a file is deleted when it's reference is removed from the table. I think the data is still there, and is slowly (or quickly depending on use of the drive's capacity) overwritten.

i also must disagree with mr. anonymous's assertion that the file is stored randomly on the disc.

the file is stored sequentially in available sectors.

If the first letter gets changed, it's only done so by the Operating System in question since Naming conventions are actually unimportant to a file.

Anyhow, I had a quick look for a site that might aid further in the development of your understanding of what actually goes on. (albeit, simplified)
http://computer.howstuffworks.com/question578.htm

If the first letter gets changed, it's only done so by the Operating System in question since Naming conventions are actually unimportant to a file.

i was talking about older file systems, mainly ibm dos.
in that system the file name was stored as the first entry in the fat in standard 8.3 format, in other words the first 11 characters of the fat entry was the file name.
when you deleted the file it changed the first character of the FAT entry to an underscore.

Well I think windows did go through a period of using Tidles "~" and .tmp extensions for dealing with "works in progress", you know your running a program beyond your systems resources and you get a nice bluescreen before having the chance to save your work. Then your left guessing which .tmp file contained what you were working on. Although this wasn't deletion, it proves even files you open and view have data stored somewhere :)

Well after Anonymouse's post (all good responses btw, learned something fr. all) i thought "database" then MFT and came across this - http://www.pcguide.com/ref/hdd/file/ntfs/archMFT-c.html :)

My link does not directly answer my questiion i will assume it is MFT that stores the changes. This is for Window's and I assume Mac\Unix\Linux call it something different.

Next I would look into file xtension changes but as in file naming there really are no illegal characters.

Thank's and any other thought?

i also must disagree with mr. anonymous's assertion that the file is stored randomly on the disc.

the file is stored sequentially in available sectors.

:) ... Sorry Leo, thought that's what I did say. Must confess, working on the fly this afternoon. Long day...

/dev/null