One click of a button and a file is gone forever - except that it's not. I'm not just talking about safety nets like the trash or recycle bin that hold on to deleted files to make sure you really, truly meant to hit delete: even when you empty those the files linger on for a while in the forgotten recesses of your computer.

There is more to storing a file on a hard drive or flash drive than just remembering its contents. To be able to retrieve the files later the drive needs to be organised, and this is a job done by a file system.

There are many different file systems with cryptic names like NTFS, FAT and HFS, but they all take a broadly similar approach to managing files.

First, they divide the storage up into blocks of a few thousand bytes each (equivalent to a few pages of text). Most of the blocks are used to hold the contents of files, but some are set aside for bookkeeping. This bookkeeping takes various forms, but a crucial part of it is that for each file stored the file system notes a name for the file, along with a list of the blocks that hold the contents of the file. The file system also keeps track of which blocks aren't currently allocated to any files, so that when new blocks are needed to satisfy a growing file, some existing file isn't clobbered.

The file system's bookkeeping is absolutely essential. If a file's list of blocks becomes corrupted, then the file's contents are effectively lost - even though they are still stored on the disk; there's no map to tell the file system where they are.

The file system exploits this when it comes time to delete a file. Instead of doing anything to the contents, the file system just erases the bookkeeping for the file, making sure to note that the blocks that belonged to the file are now free to be used again. Eventually, the former file's contents will be overwritten as those blocks are allocated to new files, but in the meantime they remain where they were, only accessible to special software that bypasses the file system and examines the blocks of the disk directly.

In principle, a recently deleted file can be pieced together, but it can be a painstaking process. This "undeleting" was popular in the early days of personal computing when drives were much smaller and more tractable and operating systems lacked safety nets to protect users from overzealous erasures.

This deletion without deletion may seem counter-intuitive but it's just saving unnecessary and wasteful work. If you disconnect your phone you expect your name to disappear from the phone book but you don't expect someone to come and rip the wires out of your house. Similarly when you delete a file it disappears from view but it isn't annihilated. Instead it haunts your hard drive, gradually fading into oblivion as its blocks are consumed one by one by other files. What a way to go.

- © Fairfax NZ News

Comments