Call:   (888) 458-3222



What happens when a file is deleted?


The Windows operating system tracks files (user data) using either a File Allocation Table or a Master File Table.  In simple terms, the FAT or MFT tells the computer where the file begins and ends.    Macintosh uses a similar system known as Nodes.


When a file is deleted, the operating system deletes the pointers to the file and in the FAT or MFT the space occupied by the file is mark as available.  The computer does not delete the actual data that was contained in the file.


Analogy:  In days gone by, our library system used a card catalog that told the user what section and what shelf the book was on.  If the card was removed from the catalog even though the book was still on the shelf, the user would not know the book existed, but the book would still be on the shelf.  When the computer removes the pointers to computer files, the data remains on the hard drive until the computer over-writes the file with different data.











Return to FAQ

Next Question: What is a Bit Stream Image?


Contact Form


Center for Computer Forensics

21800 Melrose Ave

Suite 1

Southfield, MI 48075

This website is not intended to provide legal or professional advice. The site is merely a starting point to learn about the topics listed. While we attempt to maintain current, complete and accurate information we accept no responsibility for errors or omissions.