|
Everything that has not overwritten is recoverable. IE stores temporary files and history on specific folders/position. But when you delete a file, you are not "erasing" space, you are just telling the file system that the position previously assigned to that file in now free and available. If no other file is generated or written or moved into the space previously occupied by the "deleted" file, you only have to find the "pointer" to the pertinent position and reassemble the fragments into a new file. Even 'directory entries' are not "erased", they are simply "freed up". I have simplified the theory of logical recovery programs, things in real life are something different, but the principle is this. Search for a description of the NTFS file system and see the differences between FATxx and other FS.
|