[RESOLVED] Deleted Files

[Dagotex]

The CEO of the company I work for has presented me with a question that has me a little stumped. When you delete files on a server running NT 4.0 from a workstation, where do they go? I don't care about getting them back, that's why they have backups but are they permanently deleted from the HDD or are they stored in a glorified recycle bin?

It's a good thing I don't have any real work to do around this place or I'd never asked such mundane questions.

Any help would be appreciated.

[ilovetheusers]

When you delete a file on a windows machine it just removes the file to the recycle bin. After it is deleted from there the operating system just removes all indications of it from the system. The actual data is still there, right where it last was. If you had data recovery tools you could go get it back if you wanted to unless...

Defragging the system right after deleting a file will overwrite the sectors where the old information was and permanently (more or less) remove it. Writing files over the sectors where deleted information was gets rid of it too. But, until you actually write new data over top of the sectors containing the erased data it just like closing you eyes and saying it's not there.

[thirdfey]

........................

I think you missed the question. The question is I am on a workstation and I delete a file off of the server, where does that deleted file "go"? It does go into the server recycling bin and it doesn't go into the workstation recycling bin. I would say it is just like deleting from a dos prompt which isn't that removing the first character of the filename?

[Dagotex]

Thanks for the input. Unfortunately I thought of the recycle bin on the server but I can't seem to find it. Any idea as to where that is located?

[underfunded]

The best I cold tell is that it is totally deleted. You could still get it back with an undelete program but not through the recycle bin.

[Gabriel]

Backup my friends - Backup...

[crtlaltdel]

I'm pretty sure it goes to the recycle bin on the server that file was deleted from. I will check it out and see for sure

[thirdfey]

moves it to the recycling bin? i don't know, that just sounds like a security risk, i just gets deleted

[xsrvx]

Files are only moved to the recycle bin if they are deleted from the local machine. If you delete files over the network they do not go to a recycle bin they are deleted but they are still recoverable unless of course the sector was overwritten with new data or something.

[kannibul]

when you delete from a network drive, it is gone, just as if you used del *.* from a command prompt.
some os's have a feature that allows you to recover these files, without using a backup.
Novell is one of them, I am sure there are others...
(Novell has scavenge (effect of restore from recycle bin) and purge (effect of emptying the bin)

[SubZero]

When you delete files over a network, they disappear like a magician, however they don't come back. You could try an undelete, but like it was said before, you hope a sector was not overwritten.

[condor]

Originally posted by CrtlAltDel:
I'm pretty sure it goes to the recycle bin on the server that file was deleted from. I will check it out and see for sure

Nope deleting using a network drives or UNC path is totally deleting ..

You see, the recycle bin is working only for the Explorer shell commands... Network Deletes are performed through the vritual redirector (not Explorer) - once it's gone .. it's gone..

That's why you keep backups of servers...
(well one of the reasons..)

[3fingersalute]

Recycle Bins do not exist to networks!!

It is like a standard old DOS delete, which can be recovered, by going to the server and running a standard undelete utility.

If you are talking peer to peer 95/98 boxes, it is the same thing, the file is recoverable on the host pc you deleted the file from, but it is not in the recycle bin. Get a copy of directory snoop, it is free and works great!

[cyberhh]

Keep in mind that the responses you are getting are for NT only (except where specifically noted). Other NOS' have their own ways of doing data recovery (ie. NetWare has Salvage).

On windows NT their is no way to reliably recover deleted files on the server, however you should be able to use an undelete program from the server console and recover the data, as you are interacting with the machine itself. Now, I am unsure of wheather this works on NTFS with security set high, or not.