How to read deleted files?

[Jumpercables]

When you delete a file from the recycle bin or just plan delete it, I understand that the file is not truely deleted until another file overwrites it.

Is there anyway to read memory to see the recently delete files?

[Shaggy Hiker]

I've done it with old DOS undelete tools that used to be around. Haven't tried it on WinXP, and they may not work, since they were written for FAT32 rather than NTFS that is the new file system. All deleted files appeared with the first character turned into something else. You could restore the file by renaming that first character.

[Hack]

Assuming you mean "programmatically" delete files from the recycle bin, what development platform are you using?

[Jumpercables]

Assuming you mean "programmatically" delete files from the recycle bin, what development platform are you using?

I mean programmatically, I am using Windows XP Professional.

[Hack]

I mean programmatically, I am using Windows XP Professional.

XP is your operating system. I mean what programming language do you want to attempt this in?

[Jumpercables]

XP is your operating system. I mean what programming language do you want to attempt this in?

Doh, Long day at work. I plan to do this in C# with .NET 2005.

[Shaggy Hiker]

I would guess that you can't directly. I believe that managed code means that the OS will give you a chunk of memory, and map all addresses into that memory space. This would mean that you wouldn't get to see the actual bytes at the addresses you use, but the bytes at the addresses that have been mapped for you to see. Thus if you read Byte 0, it isn't the Byte 0 of physical memory, but is byte 0 starting at the address offset the OS has allocated to your program. Since the file won't be in that memory space, you'd at LEAST need an API call to get at raw memory.