One of the advantages of the FAT file system is the ease with which it allows for files
to be undeleted, because of the way that it deletes files. Contrary to what many people
believe, deleting a file does not result in the contents of the file actually being
removed from the disk. All that the system does is mark the file as deleted.
When you delete a file, the system doesn't really delete the file. It places the hex
byte code E5h into the first letter of the file name of the file. This is a special tag
that tells the system "this file has been deleted". The space that was formerly
used by the file is available for use by other files, but it is not cleared. It is just
sort of "left there".
Over time, these clusters will eventually probably be reused by other files as they
request more clusters for storage. However, if you accidentally delete a file you can very
often recover it if you act quickly. If you run a utility like DOS's UNDELETE or Norton
Utilities' UNERASE immediately, it can identify and recover the deleted files in a
directory. As long as you provide it with the missing first character of the file name
(which was overwritten by the E5h code when the file was deleted), it may be able to
recover all or most of the file.
The less you do between the time the file is deleted and the time when you try to
undelete it, the more likely you will be able to recover the file. Obviously, if you defragment your disk or do some other large-scale disk
work, you will most likely lose the file's contents forever. Finally, many utilities will
protect your files after being deleted so they can be recovered easily without worrying
about the disk space being reused. For example, Windows 95 sends all deleted files
initially to its "Recycle Bin", from which they can be restored if needed.
Norton Utilities also includes a form of protection for recently-deleted files.
Next: Fragmentation and Defragmentation
