UnDelete - restoring deleted files

Basics

Undelete is the process of recovering accidentally deleted files. Typically term "undelete" is used when talking about recovery of one or a couple of deleted files.

The success of undelete depends on the following factors:

• filesystem type used on the disk
• whether deleted files were fragmented
• how extensively in terms of writing the disk was used once the files have been deleted

Filesystem type

File deletion is implemented in different ways in different filesystems.

For example, in NTFS file deletion boils down to setting a certain flag in file's MFT (Master File Table) record. Neither file data nor information concerning file data location on the disk are overwritten until this disk space is really required for a new file. In the other filesystems deletion may be implemented in other ways (see details for FAT and ext or HFS/HFS+).

The intensity of disk usage in terms of writting

For every filesystem the less data was written to the disk after the file deletion, the more chances to recover these files.

On the NTFS for small files (typically less than 700 bytes) the MFT (Master File Table) record stores file data along with other file attributes. Such files are called resident. Even if you overwrite all the disk capacity with non-resident (large) files, typically resident files can still be undeleted.