I’ve read that no file on your computer is ever permanently ersed by deleting it. I’ve seen programs that go in and scramble the “leftovers” so that if your compuer is sold or given away, the next person cannot see the old files.
This sounds really weird to me. If I erase it, why is it not gone?
On the other hand, I recently erased a file (a piece of email in my Sent folder in Outlook Express) that I would greatly like to be able to read again. Can I get it back (other than asking the person I sent it to to re-send it, which is impossible just now)
Thanks!
Well, it’s true. In fact, you can get hard drive recovery programs if you accidentally delete something important. They’ve saved my butt a time or two. The way I understand it is, when you delete a file, it just tells the computer “The space where deletedfile.agh was stored can now be written over.” If that space isn’t written over, the file may be recoverable.
When you delete a file, you aren’t actually deleting the data in that file, you are merely taking away the tags that mark the location of that data. Sort of like ripping the label off a file in a file drawer… the data is still there, but it’s really hard to find!
Until the actual area on the hard drive where the ‘deleted’ data resided is overwritten with new data, your old data is still there and can be recovered (with some difficulty).
As for your deleted e-mail: yes, you probably could get it back (assuming it hasn’t been overwritten), but it probably isn’t worth the effort or expense (if you took it to a shop to have them try to retrieve the file). UNLESS Outlook Express has a utility designed to fetch deleted e-mails, that is… I’m not too familiar with OE, so I can’t say.
Good luck!
Individual emails are not files themselves. They are part of a flat file system that Outlook Express uses with an extension of .ost. It may be possible to recover previous versions of the .ost file using a HD recovery program, but you’re really going to have to know what you’re doing. Did you look in your Deleted Items folder for the email or have you emptied it already?
I don’t know of any tricks with regard to recovering deleted e-mail messages, but I can answer the other half.
On most versions of Windows, deleting a file places it in the “Recycle Bin” (on Macs, the “Trash Can” IIRC), from which it can be recovered. Emptying the Recycle Bin eliminates that possibility.
However, when Windows is told to delete a file, it does not clear that file from the disk per se – it renames the first character of the file to a symbol, and marks the area occupied by the file as available for writing a new file to. But the actual contents of the file remain on the disk, albeit not accessible by you or me, until it is overwritten, and certain programs (Norton Disk Utilities being one) can identify what the file’s “new name” is and permit renaming it into a “real” file again, with the same contents (presuming no part of it has been overwritten). Like this – assume you have 2K-sized sectors on your hard drive, and this file, MYSTORY.TXT, is 3,949 bytes, therefore occupying two sectors. You delete it. It’s reassigned from “My Documents” or wherever you stored it to the Recycle Bin, but remains there. Now you empty your recycle bin. It’s renamed to %YSTORY.TXT (arbitrarily using the % as the odd symbol that is used). Several reads and writes of other files later, it happens that the two sectors formerly occupied by MYSTORY.TXT has not been overwritten. Somebody goes in with Norton File Recovery (or whatever they call it) and finds that those two sectors contain %YSTORY.TXT, makes a guess that the first character is a M, and recovers it. It has now “returned from the dead.” And the same technique can be used by an unscrupulous computer buyer to find out what that letter you sent giving instructions to your bank, with your Visa account number and secret password in it, says.
What the scramblers and such do, in reality, is nothing but replicating a file to fill up all the “empty” space on a disk (much of which was at one time or another occupied by deleted files) with a file containing a given character repeated – preferably ⌂ which is equivalent to binary 1111111. (If that displays as a box, don’t worry about it.) One can do this oneself by simply creating a small file of a repeated character and then recopying it to fill up the disk, then deleting the multiple copies to restore the disk as one wishes it to be – time-consuming but effective.
But if you defrag the hard drive doesn’t that push all the data together eliminating any empty spaces and overwriting any deleted files?
Or have I got it wrong?
Thanks for the info, trusty Dopers!
It was stored in my Sent file, which I cleared out the day after I sent it. I’ll be getting a response soon on the original email, which may include bits of the original.
Basically, I sent an email which could have been misconstrued. I didn’t hear back, so I wrote again, explaining and apologising for the bits that I thought may have been overdone. The reply I got back was that the original was not in fact too much and had been taken in exactly the way I wanted it to be, but the receiver was immensely busy coming back from a major event and leaving for another and had no time to respond properly. Now I want to re-read the original so I can be clear on exactly what the receiver is responding to. I’m expecting a response in a couple days and I guess I’m looking for one more thing to obsess about until then 
HD
As well as the fact that files are not actually removed by deletion, you can recover files that have been only partially overwritten (since fragments of a larger file may exist in partially overwritten memory clusters). Additionally, when writing to the hard disk your computer may not always hit exactly the same physical spot on the disk, so there may be recoverable traces due to these tiny movements in the disk head. There is certainly software available for recovering file fragments – it’s not cheap, and you’re unlikely to get cracked versions, since it also requires a dongle to be present – but the tools capable of the last kind of data recovery are generally only available to law enforcement groups and specialist forensic computing companies.
Apologies if any of my terminology is off, or simplistic, it’s been a year or two since my only limited involvement in forensic computing work. According to friends of mine that do it more often, it’s really not that interesting to do.
So long as you’ve not compressed your email folders, couldn’t you just do a search for the appropriate .dbx file and read it with DBXtract ?
Re: your mail, when you’re cataloguing a whole lot of text like that, works kind of like a smaller version of your harddrive. (It uses one big file, and stuffs your text in there in places).
For example, the space filled by one deleted file is left alone until another e-mail that fits in that place arrives and is stuck there.
For this reason, some of your mail that you’ve “deleted” was just flagged as usable space and not actually erased. In this case, Daizy’s suggestion might work.
If anyone cares, they can look up hash tables for more info. All this “recovery” stuff is basically due to the fact that it’s far simpler and faster to mark space as “usable” rather than delete it when it’ll be overwritten quite satisfactorily later anyhow.