Does defrag erase all trace of deleted files?

[Jackson]

If I send a file to the recycle bin and later delete it from
the recycle bin and then, still later, defrag the disk, is
it possible that the file could still be undeleted and read?

Windows XP

Thanks...
Jack from Taxacola (formerly Pensacola), FL

[Shenan Stanley]

Jackson wrote:
> If I send a file to the recycle bin and later delete it from
> the recycle bin and then, still later, defrag the disk, is
> it possible that the file could still be undeleted and read?
>
> Windows XP
>
> Thanks...
> Jack from Taxacola (formerly Pensacola), FL

Possible? Sure.
Probable? Not really.

The more you use your machine after deleting a file - the less likely
recovering that deleted file intact becomes. (In other words - the more
possible that the section of the disk that previously held the data for said
file gets reused becomes.)

If you are worried about secure deletions - there are applications out there
designed to do that - by overwriting the area several times when you tell it
to securely erase a file (instead of just removing the pointer to the
location.)

If you are concerned about losing stuff you really shouldn't have deleted,
there are applications out there for that - in some cases the same ones that
could try and recover in the scenario you have given - except in the case of
them being installed and running at all times - it is like having a second
'recycle bin' that protects all files.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

[Twayne[_2_]]

> Jackson wrote:
>> If I send a file to the recycle bin and later delete it from
>> the recycle bin and then, still later, defrag the disk, is
>> it possible that the file could still be undeleted and read?
>>
>> Windows XP
>>
>> Thanks...
>> Jack from Taxacola (formerly Pensacola), FL
>
> Possible? Sure.
> Probable? Not really.
>
> The more you use your machine after deleting a file - the less likely
> recovering that deleted file intact becomes. (In other words - the
> more possible that the section of the disk that previously held the
> data for said file gets reused becomes.)
>
> If you are worried about secure deletions - there are applications
> out there designed to do that - by overwriting the area several times
> when you tell it to securely erase a file (instead of just removing
> the pointer to the location.)
>
> If you are concerned about losing stuff you really shouldn't have
> deleted, there are applications out there for that - in some cases
> the same ones that could try and recover in the scenario you have
> given - except in the case of them being installed and running at all
> times - it is like having a second 'recycle bin' that protects all
> files.
> --
> Shenan Stanley
> MS-MVP

One additional comment: Defrag does not intentionally do anything to
prevent recovering deleted files laying on the disk. It may
coincidentally overwrite something deleted, or break it up so it can't
be assembled, but that is not its purpose. Often times complete deleted
files still lay on the platters after a defrag; it depends on a lot of
different things whether defrag may do anything to them.

[Ken Blake, MVP]

On Sun, 20 Jul 2008 11:30:21 -0500, Jackson >
wrote:

> If I send a file to the recycle bin and later delete it from
> the recycle bin and then, still later, defrag the disk, is
> it possible that the file could still be undeleted and read?


Yes.

"Deleting" a file doesn't actually delete it; it just marks the space
as available to be used. There are third-party programs that can
sometimes recover deleted files. The problem is that the space used by
the file is likely to become overwritten very quickly, and this makes
the file unrecoverable.

So your chances of successfully recovering this file are decent if you
try recovering it immediately after deleting it, and rapidly go
downhill from there. If you've been using the computer since then (for
example to write this question and read this answer), your chances are
probably very poor by now.

But if the file is important enough, it's worth a try anyway. Stop
using the computer in question immediately, if you haven't done so
already. Download an undelete program (here's one:
http://www3.telus.net/mikebike/RESTORATION.html but there are several
others to choose from; do a Google search) on a friend's computer and
bring it to yours on a floppy to try.

If this fails, your only other recourse is to take the drive to a
professional file recovery company. This kind of service is very
expensive and may or may not work in your case.

--
Ken Blake, Microsoft MVP - Windows Desktop Experience
Please Reply to the Newsgroup

[Jackson]

On Sun, 20 Jul 2008 11:30:21 -0500, Jackson
> wrote:

>If I send a file to the recycle bin and later delete it from
>the recycle bin and then, still later, defrag the disk, is
>it possible that the file could still be undeleted and read?
>
>Windows XP
>
>Thanks...
>Jack from Taxacola (formerly Pensacola), FL


Thanks Shenan, Twayne and Ken

I suspected as much.

Actually I am not trying to recover a file. I was thinking
of donating my Dell C521 to the local zoo and was looking
for an easy way to remove my stuff. I have the freeware
Eraser so I can use that, but I believe it takes a long time
because I have a large HD, 320 gbs.
Jack from Taxacola (formerly Pensacola), FL

[Shenan Stanley]

Jackson wrote:
> If I send a file to the recycle bin and later delete it from
> the recycle bin and then, still later, defrag the disk, is
> it possible that the file could still be undeleted and read?
>
> Windows XP
>
> Thanks...

Shenan Stanley wrote:
> Possible? Sure.
> Probable? Not really.
>
> The more you use your machine after deleting a file - the less
> likely recovering that deleted file intact becomes. (In other
> words - the more possible that the section of the disk that
> previously held the data for said file gets reused becomes.)
>
> If you are worried about secure deletions - there are applications
> out there designed to do that - by overwriting the area several
> times when you tell it to securely erase a file (instead of just
> removing the pointer to the location.)
>
> If you are concerned about losing stuff you really shouldn't have
> deleted, there are applications out there for that - in some cases
> the same ones that could try and recover in the scenario you have
> given - except in the case of them being installed and running at
> all times - it is like having a second 'recycle bin' that protects
> all files.

Twayne wrote:
> One additional comment: Defrag does not intentionally do anything
> to prevent recovering deleted files laying on the disk. It may
> coincidentally overwrite something deleted, or break it up so it
> can't be assembled, but that is not its purpose. Often times
> complete deleted files still lay on the platters after a defrag; it
> depends on a lot of different things whether defrag may do anything
> to them.

Ken Blake, MVP wrote:
> Yes.
>
> "Deleting" a file doesn't actually delete it; it just marks the
> space as available to be used. There are third-party programs that
> can sometimes recover deleted files. The problem is that the space
> used by the file is likely to become overwritten very quickly, and
> this makes the file unrecoverable.
>
> So your chances of successfully recovering this file are decent if
> you try recovering it immediately after deleting it, and rapidly go
> downhill from there. If you've been using the computer since then
> (for example to write this question and read this answer), your
> chances are probably very poor by now.
>
> But if the file is important enough, it's worth a try anyway. Stop
> using the computer in question immediately, if you haven't done so
> already. Download an undelete program (here's one:
> http://www3.telus.net/mikebike/RESTORATION.html but there are
> several others to choose from; do a Google search) on a friend's
> computer and bring it to yours on a floppy to try.
>
> If this fails, your only other recourse is to take the drive to a
> professional file recovery company. This kind of service is very
> expensive and may or may not work in your case.

Jackson wrote:
> Thanks Shenan, Twayne and Ken
>
> I suspected as much.
>
> Actually I am not trying to recover a file. I was thinking
> of donating my Dell C521 to the local zoo and was looking
> for an easy way to remove my stuff. I have the freeware
> Eraser so I can use that, but I believe it takes a long time
> because I have a large HD, 320 gbs.

Format it and install with the original installation media. For most - this
will ensure things will not be recovered. Do not just try and remove your
stuff... You'll either miss something or they will do the wise thing and
wipe it/install from the original media anyway.

Extra paranoid - just use Darik's Boot n' Nuke... Just start it up one
evening and it should be done within 24 hours or so - less dependent on size
of the drive. Then format and install fresh with the original installation
media. Or don't and just give them the computer and the original
installation media and tell them to enjoy!

http://dban.sourceforge.net/

Then when you give the machine away - make sure they have the copy of the
original installation media. Want to be extra nice - make an extra copy of
the original installation media and give both copies to them - tell them to
store the other elsewhere (or smartly don't tell them and tape the extra
copy inside the computer case.)

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

[Twayne[_2_]]

....
(or smartly don't tell
> them and tape the extra copy inside the computer case.)
>
> --
> Shenan Stanley
> MS-MVP

That's an EXCELlent idea! So simple I never thought of it, never heard
anyone else mention it ieither. THAT's thinking outside, err, well,
maybe inside in this case, the box!

Twayne