Contents of recyle bin.

[JuliaSix]

Can anyone tell me please where the contents of my computer recycle bin go? I was waiting to ask this question (Along with many more I have) of God when my time comes, but now I've found the answerbank, I don't have to wait.

[Mickey_Blue]

When a file is deleted from the Recycle Bin, or if the recycle bin is bypassed altogether, the file can no longer be recovered by the Windows Operating system. The content of the file still remains on the drive, relatively intact, until the section of the drive it occupies is overwritten by another file.

[gary baldy]

Dont listen to Mickey Blue! We all know that they go to a far corner of cyber space and one day all the trash will bounce off the outside wall of the universe and come flying back, drowning us in millions of old Word files and naughty pictures.

[fo3nix]

A fairly simplified answer:

Most file systems (the common ones, anyway. Forget about the weird research ones) are comprised of two things:

- TOC, Table Of Contents
- the data itself

the TOC is just like the TOC in a book. its just a list of what files are on the disk, and where on the disk they are (some special number). When you access a file, your operating system goes to the TOC to see where it is, then goes to that point on the disk to read the data itself. All this is invisible to you, the user.

When you delete something, to the recycle bin, the data is still there, just in a special part of the disk. (the recycle bin part).

If you delete something from the recycle bin, then all your computer does is change its address in the TOC to a load of zeros, like 00000000, effectively making it blank. It doesn't touch the data itself.

So a data recovery program can go along and search the raw data, to see if it picks up anything that's not meant to be there. Using a variety of techniques, it can generally tell what sort of file it was, and bring it back to life. However, since that part of the disk has been marked blank by the operating system, any program is free to write to that bit of the disk, or even start writing before your data and overlap into your data itself, effectively destroying it.

You may have seen "secure erase" features. This basically just overwrites the data itself several times using random data, so that a recovery tool can't recover your file that you want kept removed. Then it changes the TOC address to all zeros as normal.

[boobesque]

fab answer f03nix. we worship thee

[qapmoc]

I read somewhere that you have to overwrite the file data at least 20 times if you want to be 100% sure that nothing remains to be found on the disk. Apparently it relates to the fact that the disk read/write heads never exactly cover the previously written track and can leave a small ''stripe'' of data along the track edge on the first few passes of the heads.

[fo3nix]

qapmoc: yea you're right. once or twice will be fine for the average commerical recovery tool. But you need to do it many times (even encrypt using a random key), to evade people who have more powerful tools (the government, etc.)