SOC Experts Community - Beta
0 like 0 dislike
in General Questions by (4.1k points)

1 Answer

0 like 0 dislike
by (5.9k points)
Windows (and other operating systems) keep track of where files are on a hard drive through “pointers.” Each file and folder on your hard disk has a pointer that tells Windows where the file’s data begins and ends.

When you delete a file, Windows removes the pointer and marks the sectors containing the file’s data as available. From the file system’s point of view, the file is no longer present on your hard drive and the sectors containing its data are considered free space.

However, until Windows actually writes new data over the sectors containing the contents of the file, the file is still recoverable. A file recovery program can scan a hard drive for these deleted files and restore them. If the file has been partially overwritten, the file recovery program can only recover part of the data.

SOC Experts - No. 1 Job Oriented Cybersecurity Training Program

View our Courses