The following changes occur to the disk when a file is deleted:

• The first character of the filename would be replaced with a lowercase sigma character.
• Two entries, one for the deleted file and one for its associated long file name (LFN) are created in file allocation table. These include:
• Erased. An erased file
• Del LFN. An LFN belonging to an erased file.

The operating system will image the clusters in which the file is stored are available for reuse. Therefore, these clusters might be overwritten by new data if the undelete action is not carried out instantly. Based on the file type, the file can be destroyed even when just one cluster is overwritten.

File Undelete:

The file undelete process involves four steps:

• Restoring the original filename
• Finding the clusters used by the file
• Recreating the FAT entries for the file
• Relinking the LFN enteries for the file to the file

Of these four steps, the most critical are locating the clusters used by the file and recreating the FAT entries for the file. However restoring a deleted program file to its original name is necessary. Or else the program would not function properly. Restoring the LFN entries enables a Windows users accustomed to long filenames to more easily use the file.

How to Recover Data

If you want to undelete the file, you can use data recovery tools for instance REMO Recover. REMO Recover (Windows) is an integrated utility suit that could be used to retrieve deleted files. Additionally , it has email recovery feature that could be used to recover outlook emails.