15.01.2024 Views

CompTIA A+ Certification All-in-One Exam Guide

  • No tags were found...

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Assuming these files are all in the same folder, the file information looks

like this:

Now suppose you erase mom.txt. Windows does not delete the block

entries in the FAT for mom.txt when it erases the file. Windows only alters

the information in the folder, simply changing the first letter of mom.txt to

the lowercase Greek letter σ (sigma), as shown next. This causes the file to

“disappear” as far as the OS knows. It won’t show up, for example, in

Windows Explorer, even though the data still resides on the hard drive for the

moment.

Note that under normal circumstances, Windows does not actually delete

files when you press the delete key. Instead, Windows moves the file listing

(but not the actual blocks) to a special hidden directory that you can access

via the Recycle Bin. The files themselves are not actually deleted until you

empty the Recycle Bin.

Because the data for mom.txt is intact, you could use some program to

change the σ back into another letter and thus get the document back. A

number of third-party undelete tools are available. Figure 9-21 shows one

such program at work. Just remember that if you want to use an undelete tool,

you must use it quickly. The space allocated to your deleted file may soon be

overwritten by a new file.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!