Tech moves fast! Stay ahead of the curve with Techopedia!
Join nearly 200,000 subscribers who receive actionable tech insights from Techopedia.
Undelete refers to the process used to recover computer files, text, or data that have been discarded or deleted. When you delete a file, it may still reside on the hard drive somewhere; if so, you may be able to undelete it.
Temporary data file folders or directories may be referred to by different names, depending on the operating system or software application. When files are deleted from a temporary storage location, undeleting the data becomes more difficult, or even impossible.
In a File Allocation Table (FAT)16 file system, an undelete function is supported. Whenever a file is deleted, the file system keeps the directory entry with all the related information, including physical location, timestamp, name, and length. Only the file allocation table is updated to mark those sectors as available for reuse by other files. This directory entry is used by FAT16 system software to undelete a file. In general, you have a better chance of undeleting a file in a FAT16 file system than in a FAT32 file system. Most modern UNIX file systems, with the exception of AdvFS, do not support undeletion.
An OS or application undelete feature can pose security risks. For example, a user with network access may be able to retrieve a previous user’s inadvertently-stored sensitive information.
Even if data recovery personnel and programs are established, it may not be possible to recover deleted data unless the following criteria are met: