not a beginners quest, but dont know where to post

tadtadtad · #1 Apr 4, 2008, 03:10 AM

i dont think my idea will work but im going to try

im looking for some tips and tricks to help me on my way may be you can hlp

my idea is that when you delete a file it still stored in your fat clusters and the only way the info is completly erased is when the clusters are copied over by another file

my hpes is to use evidence eleminator wipe clean and start from scratch

delete a file find the file in my im guessing ntfs -or fat --(any ideas)

copy and paste to another folder

this is step one

======================

step two would be to take files to another computer follow same steps above acceppt copy and paste the fils into ntfs -or fat --(any ideas)

and use a file undeleter --Recuva--
to undelete the clusters - or the files

if this works imagine the possibilitis
this means that tranfering 50 gigs online could be as little as a gig of info uploaded

and safer

im sure that im doing something wron in my equation any info that you can think of harv. would be apprieciated

Benjimeister · Apr 4, 2008, 10:46 AM

The problem with this method, I think would be that data recovery doesn't work by restoring the data from the leftovers in the NTFS/FAT tables...

IT Helpp · Apr 8, 2008, 11:04 AM

If what you describe works, I don't understand how you expect to get 50/1 compression. Even when deleted, the cluster version of the file is still the same size.

retsoksirhc · Apr 8, 2008, 11:21 AM

The reason it wouldn't work is because when you copy/paste, you're using the filesystem itself, which has no record of those files ever being there. You wouldn't be able to restore them from the new drive.

They would still be on the old drive, but the filesystem just doesn't know about them anymore. If you wanted to get them back, you would have to go through and do a sector by sector scan...and if you wanted to copy something that wasn't in the filesystem, you would have to do a sector by sector copy....which would actually take up more space. This is because the sector copy would be all the sectors, even those which files aren't currently stored in...that are on the drive. Including the free sectors available to write to. So if you had 10gB on a 20gB drive, and deleted 5gB, a sector copy, which would be able to do what you're suggesting, would still be 20gB, even though there isn't that much usable information.

This was harder to explain than I thought it would be...I hope I didn't lose you.



At Ask Me Help Desk you can ask questions in any topic and have them answered for free by our experts. To ask questions or participate in answering them you must register for a free account. By registering you will be able to: Get free answers from experts in any of our 300+ topics. Accept money for answers that you provide. Communicate privately with other members (PM). See fewer ads. Sign Up!