Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > NZ Computing > An unusual way to free up hard drive space?

Reply
Thread Tools

An unusual way to free up hard drive space?

 
 
Barry OGrady
Guest
Posts: n/a
 
      05-29-2006
On Sun, 28 May 2006 09:32:11 +1200, "JB" <(E-Mail Removed)> wrote:

>Thanks Fred for this explanation. When I filled up the drive and then
>deleted the new additions, I thought I may gain a little more space as a
>result of deleting permanently, files that had already been "deleted" from
>the recycle bin. I had heard that deleted files are never permanently
>deleted until the space is required for other files. This is why various
>recovery programs can "undelete" previously deleted files. Is this correct?


Not quite. Windows has a directory and a file allocation table. When a file
is to be created or extended Windows looks at the fat to determine where
the data can be put. When a file is deleted the directory entry is not removed
but is altered to show that it is no longer active and the fat is updated to
show the area the file occupied is free. If the data area and the directory
entry are not overwritten the file can be recovered by changing the directory
entry to show the file in use again.

>Regards, JB


Barry
=====
Home page
http://members.iinet.net.au/~barry.og
 
Reply With Quote
 
 
 
 
JB
Guest
Posts: n/a
 
      05-29-2006

"Barry OGrady" <(E-Mail Removed)> wrote in message
news(E-Mail Removed)...
> On Sun, 28 May 2006 09:32:11 +1200, "JB" <(E-Mail Removed)> wrote:
>
>>Thanks Fred for this explanation. When I filled up the drive and then
>>deleted the new additions, I thought I may gain a little more space as a
>>result of deleting permanently, files that had already been "deleted"
>>from
>>the recycle bin. I had heard that deleted files are never permanently
>>deleted until the space is required for other files. This is why various
>>recovery programs can "undelete" previously deleted files. Is this
>>correct?

>
> Not quite. Windows has a directory and a file allocation table. When a
> file
> is to be created or extended Windows looks at the fat to determine where
> the data can be put. When a file is deleted the directory entry is not
> removed
> but is altered to show that it is no longer active and the fat is updated
> to
> show the area the file occupied is free. If the data area and the
> directory
> entry are not overwritten the file can be recovered by changing the
> directory
> entry to show the file in use again.


Thanks Barry for this explanation. Would the data area and the directory
entry be overwritten when a hard drive becomes full as a result of new data
being added? In other words, can the filling up of a hard drive with new
data prejudice the "undeleting" of files that may have been accidently
deleted before the new data was added?



 
Reply With Quote
 
 
 
 
Fred Dagg
Guest
Posts: n/a
 
      05-29-2006
On Mon, 29 May 2006 13:37:27 +1000, Barry OGrady
<(E-Mail Removed)> exclaimed:

>On Sun, 28 May 2006 09:32:11 +1200, "JB" <(E-Mail Removed)> wrote:
>
>>Thanks Fred for this explanation. When I filled up the drive and then
>>deleted the new additions, I thought I may gain a little more space as a
>>result of deleting permanently, files that had already been "deleted" from
>>the recycle bin. I had heard that deleted files are never permanently
>>deleted until the space is required for other files. This is why various
>>recovery programs can "undelete" previously deleted files. Is this correct?

>
>Not quite. Windows has a directory and a file allocation table. When a file
>is to be created or extended Windows looks at the fat to determine where
>the data can be put. When a file is deleted the directory entry is not removed
>but is altered to show that it is no longer active and the fat is updated to
>show the area the file occupied is free. If the data area and the directory
>entry are not overwritten the file can be recovered by changing the directory
>entry to show the file in use again.


Hi, Barry. Not quite correct, I'm afraid.

We're talking NTFS rather than FAT. In NTFS, details of the files are
stored in metadata in the Master File Table (MFT). Tools physically
scan the drive to piece together deleted files (although there are
other things that can also be done, beyond the scope of this post!)
 
Reply With Quote
 
Fred Dagg
Guest
Posts: n/a
 
      05-29-2006
On Mon, 29 May 2006 15:50:21 +1200, "JB" <(E-Mail Removed)> exclaimed:

>
>"Barry OGrady" <(E-Mail Removed)> wrote in message
>news(E-Mail Removed).. .
>> On Sun, 28 May 2006 09:32:11 +1200, "JB" <(E-Mail Removed)> wrote:
>>
>>>Thanks Fred for this explanation. When I filled up the drive and then
>>>deleted the new additions, I thought I may gain a little more space as a
>>>result of deleting permanently, files that had already been "deleted"
>>>from
>>>the recycle bin. I had heard that deleted files are never permanently
>>>deleted until the space is required for other files. This is why various
>>>recovery programs can "undelete" previously deleted files. Is this
>>>correct?

>>
>> Not quite. Windows has a directory and a file allocation table. When a
>> file
>> is to be created or extended Windows looks at the fat to determine where
>> the data can be put. When a file is deleted the directory entry is not
>> removed
>> but is altered to show that it is no longer active and the fat is updated
>> to
>> show the area the file occupied is free. If the data area and the
>> directory
>> entry are not overwritten the file can be recovered by changing the
>> directory
>> entry to show the file in use again.

>
>Thanks Barry for this explanation. Would the data area and the directory
>entry be overwritten when a hard drive becomes full as a result of new data
>being added? In other words, can the filling up of a hard drive with new
>data prejudice the "undeleting" of files that may have been accidently
>deleted before the new data was added?
>


Hang on, I think you're getting confused.

Think of it as a locker room at a sports club, however in this sports
club, people don't clean out their locker when they leave.

There is a big board on the wall that says who owns which locker (as
well as other info about the members). This is akin to the MFT.

When someone leaves, their name is scraped off the board, but their
locker isn't touched. When someone else joins, they may be assigned
this free locker (or just as easily, another one). If they are
assigned a locker, the first thing they do is clear out anything that
is already there, and throw it in the incinerator.

Now, if a locker has been freed (ie a member left), but a new member
hasn't been assigned to it, it's possible to open that locker and
retrieve anything that is in there, even though the board says it is
empty.

Note also that any one member may take up a number of lockers.
Obviously if the lockers are right beside each other, it's quicker for
the member to retrieve everything from the lockers, rather than having
to run backwards and forwards if they're located in different places.

There are also reserved lockers right by the pool, so the pool
supervisors can store stuff without having to walk all the way to the
other end of the locker room. However, if the locker room becomes
full, any unused supervisor lockers are freed up for members (and then
the supervisors just get allocated any old locker if they need them in
the future, slowing them down a little).

This is (obviously a simplification of) how it works with files. You
could count up that there were 10 lockers free, and use these.
However, until the locker (or location on the drive) was used by a new
member (file), it would be possible to retrieve what was previously
there.

Having said all that, the MFT does actually retain some information
about deleted files, however a full scan of the drive (ie look in
every locker that is marked as unused) is really necessary to recover
everything.
 
Reply With Quote
 
Jasen Betts
Guest
Posts: n/a
 
      05-29-2006
On 2006-05-29, JB <(E-Mail Removed)> wrote:

> Thanks Barry for this explanation. Would the data area and the directory
> entry be overwritten when a hard drive becomes full as a result of new data
> being added? In other words, can the filling up of a hard drive with new
> data prejudice the "undeleting" of files that may have been accidently
> deleted before the new data was added?


Oh yeah! unless you're the CIA, the deleted stuff is gone.

Bye.
Jasen
 
Reply With Quote
 
Barry Watzman
Guest
Posts: n/a
 
      05-30-2006
As one Barry to another, I have to "not quite" to your own "not quite".

First, your explanation is correct only for disk partitions using the
FAT (any FAT, e.g. FAT12, FAT16 or FAT32) file system. It's totally
wrong for NTFS, which has no FAT table at all, and no directory as such
things exist in the FAT file system (there are other, different data
structures that server those purpose, but which are structured and work
totally differently).

Second, even on a FAT partition, assuming that you find the directory
entry for a deleted file and change it back, you will have no way of
KNOWING whether or not the clusters associated with that file had ever
been overwritten with other data (hence making the file, if recovered,
corrupt) or not.

Third, while changing the directory entry back it's unrecovered state
will allow reading of the clusters that once contained file, it will
not, in and of itself, remove those clusters from the free space linked
list of clusters (some file recovery utilities may do this, but the
operating system itself won't).


Barry OGrady wrote:
> On Sun, 28 May 2006 09:32:11 +1200, "JB" <(E-Mail Removed)> wrote:
>
>
>>Thanks Fred for this explanation. When I filled up the drive and then
>>deleted the new additions, I thought I may gain a little more space as a
>>result of deleting permanently, files that had already been "deleted" from
>>the recycle bin. I had heard that deleted files are never permanently
>>deleted until the space is required for other files. This is why various
>>recovery programs can "undelete" previously deleted files. Is this correct?

>
>
> Not quite. Windows has a directory and a file allocation table. When a file
> is to be created or extended Windows looks at the fat to determine where
> the data can be put. When a file is deleted the directory entry is not removed
> but is altered to show that it is no longer active and the fat is updated to
> show the area the file occupied is free. If the data area and the directory
> entry are not overwritten the file can be recovered by changing the directory
> entry to show the file in use again.
>
>
>>Regards, JB

>
>
> Barry
> =====
> Home page
> http://members.iinet.net.au/~barry.og

 
Reply With Quote
 
Barry Watzman
Guest
Posts: n/a
 
      05-30-2006
Definitely not true. A file that has been erased but not overwritten is
easily recovered using end-user consumer tools.

A file that has been erased AND overwritten, now that is a case that
gets into the realm of forensic recovery that falls within the realm of
[pretty much only] the CIA, FBI or NSA.


Jasen Betts wrote:

> On 2006-05-29, JB <(E-Mail Removed)> wrote:
>
>
>>Thanks Barry for this explanation. Would the data area and the directory
>>entry be overwritten when a hard drive becomes full as a result of new data
>>being added? In other words, can the filling up of a hard drive with new
>>data prejudice the "undeleting" of files that may have been accidently
>>deleted before the new data was added?

>
>
> Oh yeah! unless you're the CIA, the deleted stuff is gone.
>
> Bye.
> Jasen

 
Reply With Quote
 
Barry OGrady
Guest
Posts: n/a
 
      06-07-2006
On Mon, 29 May 2006 16:51:23 +1200, Fred Dagg <(E-Mail Removed)> wrote:

>On Mon, 29 May 2006 13:37:27 +1000, Barry OGrady
><(E-Mail Removed)> exclaimed:
>
>>On Sun, 28 May 2006 09:32:11 +1200, "JB" <(E-Mail Removed)> wrote:
>>
>>>Thanks Fred for this explanation. When I filled up the drive and then
>>>deleted the new additions, I thought I may gain a little more space as a
>>>result of deleting permanently, files that had already been "deleted" from
>>>the recycle bin. I had heard that deleted files are never permanently
>>>deleted until the space is required for other files. This is why various
>>>recovery programs can "undelete" previously deleted files. Is this correct?

>>
>>Not quite. Windows has a directory and a file allocation table. When a file
>>is to be created or extended Windows looks at the fat to determine where
>>the data can be put. When a file is deleted the directory entry is not removed
>>but is altered to show that it is no longer active and the fat is updated to
>>show the area the file occupied is free. If the data area and the directory
>>entry are not overwritten the file can be recovered by changing the directory
>>entry to show the file in use again.

>
>Hi, Barry. Not quite correct, I'm afraid.
>
>We're talking NTFS rather than FAT. In NTFS, details of the files are
>stored in metadata in the Master File Table (MFT). Tools physically
>scan the drive to piece together deleted files (although there are
>other things that can also be done, beyond the scope of this post!)


I stand corrected, but isn't it still they case that the data are is still marked
as free and can be overwritten?

Barry
=====
Home page
http://members.iinet.net.au/~barry.og
 
Reply With Quote
 
Barry OGrady
Guest
Posts: n/a
 
      06-07-2006
On Mon, 29 May 2006 07:04:37 -0000, Jasen Betts <(E-Mail Removed)> wrote:

>On 2006-05-29, JB <(E-Mail Removed)> wrote:
>
>> Thanks Barry for this explanation. Would the data area and the directory
>> entry be overwritten when a hard drive becomes full as a result of new data
>> being added? In other words, can the filling up of a hard drive with new
>> data prejudice the "undeleting" of files that may have been accidently
>> deleted before the new data was added?

>
>Oh yeah! unless you're the CIA, the deleted stuff is gone.


I had an IBM System 34 mini computer. It didn't use any OS that I am familiar
with. It treated the two 65 meg hard dives as one volume and all files were
contiguous. The OS gave a choice when deleting a file of overwriting the data
area with zeros

>Bye.
> Jasen


Barry
=====
Home page
http://members.iinet.net.au/~barry.og
 
Reply With Quote
 
Barry OGrady
Guest
Posts: n/a
 
      06-07-2006
On Tue, 30 May 2006 00:34:17 GMT, Barry Watzman <(E-Mail Removed)> wrote:

>Jasen Betts wrote:
>
>> On 2006-05-29, JB <(E-Mail Removed)> wrote:
>>
>>
>>>Thanks Barry for this explanation. Would the data area and the directory
>>>entry be overwritten when a hard drive becomes full as a result of new data
>>>being added? In other words, can the filling up of a hard drive with new
>>>data prejudice the "undeleting" of files that may have been accidently
>>>deleted before the new data was added?

>>
>>
>> Oh yeah! unless you're the CIA, the deleted stuff is gone.

>
>Definitely not true. A file that has been erased but not overwritten is
>easily recovered using end-user consumer tools.
>
>A file that has been erased AND overwritten, now that is a case that
>gets into the realm of forensic recovery that falls within the realm of
>[pretty much only] the CIA, FBI or NSA.


Surely if the disk space is fully used all deleted files are overwritten.

>> Bye.
>> Jasen


Barry
=====
Home page
http://members.iinet.net.au/~barry.og
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Hard drive is Disk 0 CHANGES to hard drive is Disk 1??? And still works!!! Spin Computer Support 7 04-09-2008 09:04 PM
Hard drive is Disk 0 CHANGES to hard drive is Disk 1??? And still works!!! Spin Windows 64bit 10 04-09-2008 09:04 PM
Change Master/Boot Hard Drive to Slave/Non boot Hard Drive & Visa Versa Steve808us@yahoo.com Computer Information 0 01-18-2005 01:57 PM
Help, Hard Drive hell......Hard drive not installing. Win98se Anthropy Computer Support 4 02-24-2004 08:54 PM
Moving Mozilla files from old hard drive to new hard drive Nate Firefox 1 02-21-2004 09:09 PM



Advertisments