Undeletion is a feature for restoring computer files which have been removed from a file system by file deletion. Deleted data can be recovered on many file systems, but not all file systems provide an undeletion feature. Recovering data without an undeletion facility is usually called data recovery, rather than undeletion. Although undeletion can help prevent users from accidentally losing data, it can also provide a computer security risk, since users may not be aware that deleted files remain accessible.

Support

Not all file systems or operating systems support undeletion. Undeletion is supported by DOS, but is not supported by most modern UNIX file systems, though AdvFS is a notable exception. The ext2 file system has an addon program called e2undel1 which allows file undeletion, although the similar ext3 file system does not support undeletion.

Graphical user environments often take a different approach to undeletion by introducing a "holding area" for files to be deleted. Undesired files are moved to this holding area, and all of the files in the holding area are periodically deleted. This approach is used by the Trash can in Macintosh operating systems and by the recycle bin in Microsoft Windows. This is a natural continuation of the approach taken by earlier systems, such as the limbo group used by CP/M2.

Another approach is offered by programs such as Norton GoBack (formerly Roxio GoBack): a portion of the hard disk space is set aside for file modification operations to be recorded in such a way that they may later be undone. This process is usually much safer in aiding recovery of deleted files than the undeletion operation as described below.

Limitations

Undeletion is not fail-safe. In general, the sooner undeletion is attempted, the more likely it will be successful. Fragmentation of the deleted file may also reduce the probability of recovery, depending on the type of file system (see below). A fragmented file is scattered across different parts of the disk, instead of being in a contiguous area.

Mechanics

The workings of undeletion depend on the file system on which the deleted file was stored. Some file systems, such as HFS, can not provide an undeletion feature because no information about the deleted file is retained (except by additional software, which is not usually present). Some file systems, however, do not erase all traces of a deleted file, including the FAT file system:

FAT file system

When a file is deleted on a FAT file system, its directory entry remains stored on the disk, slightly renamed in a way that marks the entry in FAT table as available for use by newly created files thereafter. Most of its name, time stamp, file length and — most importantly — location on the disk, remain unchanged in the directory entry (root directory which is represented using . or .. in FAT 16 or FAT32). The list of disk clusters occupied by the file will be erased from the File Allocation Table, however, marking those sectors available for use by other files created or modified thereafter.