When you delete a file in Windows, what happens?
Here's an example: You open Windows Explorer, navigate to C:\Files and highlight the file test.txt.
When you ask Windows Explorer to list the files in the C:\Files folder, Windows doesn't go through every file on the drive. Instead, it has an index of all the files in every folder that it can refer to - it's much faster. Windows Explorer uses that index to show you the names of the files.
Now, say you click Delete. (We'll talk about the Recycle Bin here - in this article, we're assuming it's turned off.)
All Windows does is erase the test.txt entry from the index - not the hard drive. The contents of the file are still there, but you can't access it.
If only you could recreate that index entry so you could get at the file! That's what Recuva does.
When a file has an index entry (in a special file called the Master File Table (MFT), Windows makes sure not to overwrite the space on the hard drive where the file resides. Once you delete the file, however, Windows is free to use that 'blank space' for other files.
Eventually, if you add, copy, move or save enough other files, the contents of the test.txt file will be overwritten. The longer you wait, the harder it will be to recover.
Ironically, the shorter the life of the file, the harder it will also be to recover. Say you create test.txt at 9:01am and delete it at 9:10am. Chances are, it will be quickly overwritten by temporary files. Windows assigns the lowest MFT entry it can find for a new file. When you delete that new file, Windows marks that MFT entry as available. Since the MFT entry is a low number, Windows will reuse it as soon as new files are created.
See How Recuva works for more information.
