Join Us!

Analogy for explain...
 
Notifications
Clear all

Analogy for explaining how a file is deleted?  

Page 1 / 3
  RSS
datacarver
(@datacarver)
Active Member

I would prefer some type of analogy to explain how a file is deleted. Very general and very dumbed down. Just seeing if you guys already had something.

Quote
Posted : 11/01/2010 8:58 am
juo_siva
(@juo_siva)
New Member

I just say when a file is deleted, it is not premanently removed from the storage media and can be recovered by some special tools.

ReplyQuote
Posted : 11/01/2010 9:16 am
 Anonymous

Think of a file as a labeled manila folder containing printed pages (file content). "Deleting" a file is like peeling the label off the manila folder. The original content is still there.

When "you" (the Operating System) need a new folder, you grab that now "available" unlabeled folder, add new content (effectively tossing the old pages) and stick on a new label.

Does that work?

ReplyQuote
Posted : 11/01/2010 9:51 am
Beetle
(@beetle)
Active Member

Think of a file as a labeled manila folder containing printed pages (file content). "Deleting" a file is like peeling the label off the manila folder. The original content is still there.

When "you" (the Operating System) need a new folder, you grab that now "available" unlabeled folder, add new content (effectively tossing the old pages) and stick on a new label.

Does that work?

This is similar to one I use comparing the organizing of a file system to the catalogue in a library."Deleting a file is like tearing up the catalogue reference card, but the book is still on the shelf". I found it works pretty well in court because judges are familiar with the Dewey catalogues in the law libraries.

ReplyQuote
Posted : 11/01/2010 10:28 am
Patrick4n6
(@patrick4n6)
Senior Member

This is my FAT analogy

A file system is like a filing cabinet full of hanging folders. At the front of the cabinet is list of all the files, and within which folders they are contained. When a file is deleted, the entry for that file on the list is marked as available to be used, but the folder is not emptied until you replace it with a new file.

At some point, a new file entry may be written over the entry in the list, and also at some point the folder may have it's contents taken out to make room for a new file. These events don't necessarily happen at the same time. Only once the contents of the folder have been thrown out to be replaced with a new file is the old file truly gone.

Caveats on that comment for file slack, but that's good enough for starters. I use an analogy of wiping off part of a whiteboard for file slack. Also of course you can use different security software and features, and different file systems manage this slightly differently. NTFS for example combines both the index and the file for resident files. For non-resident files, if the run lists can be completely contained in a single entry, it's much easier to recover than for example FAT if the file is fragmented. Of course, when a resident file entry is overwritten, so is the file content itself (again caveat for record slack).

ReplyQuote
Posted : 11/01/2010 10:28 am
datacarver
(@datacarver)
Active Member

Thanks guys, these are good. D

ReplyQuote
Posted : 11/01/2010 12:32 pm
jaclaz
(@jaclaz)
Community Legend

Just for the record, I think at FAT as I would do for a book.

A book has an index of chapters printed on first (or last) pages with the number of page where they begin, and the actual chapters printed on actual "content" pages.

If you tear the index pages off, you cannot find anymore the beginning of each chapter without browsing through pages, but since chapters and pages are numbered and binded in numerical order, it is relatively easy to find the chapter beginning by browsing the book.

Now imagine that the book has been binded together with chapters in random order by a mad typograph.

Finding a chapter starts to be daunting, as you have to go on average through 50% of the pages to find your chapter.

But you still have pages in order and the actual chapter number and title printed.

Now what, if chapter number and first letter of the chapter title were (for a problem of ink supply in the printing machine) not printed?

You have "deleted" the files, but the files are there allright, as well as their names, with only first letter missing.

Let's go a bit further…

Now imagine that the madder assistant to the typograph has shuffled all pages and thus they are in random order.

You have a severely fragmented book and should run DEFRAG more often.

You have page numbers, thus with some time you can find everything allright, page numbers are nothing but "sector #" in the FAT chain.

Now imagine that the even madder assistant to the assistant has used fluid corrector to blank all page numbers and the whole chapter titles.

You can still probably find everything allright matching the end of the sentence on page n with the beginning on page n+1.

You can still probably assemble chapters in a "logical" order, but the name of the chapters is lost for good.

You have not only "deleted" the files, but also "formatted" the filesystem.

Now, imagine that the used ink is defective and fades away with ultraviolets (let's assume that it actually leaves no trace).

You take each page one by one and put it under a strong ultraviolet light source for an adequate amount of time.

You have "zeroed out" the disk.

Notwithstanding the evidence that our fictional ink is actually perfectly volatile, a lot of people will tell you that you need to re-print several times random books on the same pages BEFORE exposing them to the ultraviolet light source.

Welcome to the DOD or Gutmann's several passes.

You should also make sure to find another typograph, this firm seems like not very reliable…..there is a firm called NTFS that is said to be better….

wink

jaclaz

ReplyQuote
Posted : 11/01/2010 4:24 pm
CFP001
(@cfp001)
Junior Member

Depends on who you are trying to explain this to.

I use the trash can explanation. You throw away a piece of trash is the can, but is it really gone? Can you rifle through the trash and find what you are looking for, albeit sometimes a little crinkled?

ReplyQuote
Posted : 11/01/2010 4:25 pm
nigel_cro
(@nigel_cro)
Junior Member

For NTFS

A huge warehouse, full of shelving units with many many pigeon holes. At the front of the warehouse is a small office with an old fella and a clipboard (identify the old fella as a retired policeman - usually gets a laugh from the jury)

Person wants to store 'stuff' - retired policeman takes stuff from person and stores in a pigeon hole - marks on clipboard so he can find it again.

Person no longer wants stuff stored - tells retired policeman who crosses out entry on clipboard but is too tired to actually go into the warehouse, find the 'stuff' and remove it. So it stays where it was.

Etc etc - I'm sure you get the idea - improve and adapt as required. I have used this many times in court and it always seems to go across well.

Nigel

ReplyQuote
Posted : 11/01/2010 4:47 pm
mscotgrove
(@mscotgrove)
Senior Member

I recently had a 'heated 'discussion over a pub lunch on this topic. My friend thought the word Delete was wrong as the data was still there.

He finally accepted the Trash bin explaination that CFP001 gave.

I also describe in simple terms deleting is like throwing away the telephone directory. You can reconstruct it by phoning every number and asking who is there.

ReplyQuote
Posted : 11/01/2010 5:45 pm
joethomas
(@joethomas)
Member

I use the analogy of a video cassette.
When you write to a file it's like recording a video and writing a label on the case, e.g. "Die Hard 3".
When a file is deleted, the label on the case is removed. The video is still there and you can still view it, you just have to know where it starts.
If you overwrite the deleted file its like recording over the video. Your label may say "House episode 7" but you can still see that "Die Hard 3" was on there and recover a large amount of it.

ReplyQuote
Posted : 11/01/2010 7:36 pm
datacarver
(@datacarver)
Active Member

I use the analogy of a video cassette.
When you write to a file it's like recording a video and writing a label on the case, e.g. "Die Hard 3".
When a file is deleted, the label on the case is removed. The video is still there and you can still view it, you just have to know where it starts.
If you overwrite the deleted file its like recording over the video. Your label may say "House episode 7" but you can still see that "Die Hard 3" was on there and recover a large amount of it.

This is a good analogy for explaining slack space.

ReplyQuote
Posted : 12/01/2010 12:16 am
CforPro
(@cforpro)
Junior Member

I use the analogy that jaclaz used. It is like a book with an index. When a file is deleted the index entry is erased, notifying the author that they can write on that page again. Until they write on it again, the old text is still there.

ReplyQuote
Posted : 12/01/2010 12:27 am
jaclaz
(@jaclaz)
Community Legend

I also describe in simple terms deleting is like throwing away the telephone directory. You can reconstruct it by phoning every number and asking who is there.

No you cannot. (

Everybody LIES.

I don't ask why patients lie, I just assume they all do.

It's a basic truth of the human condition that everybody lies. The only variable is about what.

Seriously, just imagine that someone calls your home and asks for your name and address….

wink

jaclaz

ReplyQuote
Posted : 12/01/2010 12:43 am
mscotgrove
(@mscotgrove)
Senior Member

I will defend my telephone analogy!

In data carving a raw disk image, one looks at every sector. Some sectors will start say 0xff 0xd8 and you can start saying that it is a JPEG. Others will start 'MZ' and you can say it is an EXE or DLL.

Some will look like text, others compressed data. Many will have no distinct pattern and so tell you nothing. In otherwords, some will tell you the truth, and some will tell you nothing, or just confuse you.

However you get the information back, deleted files are like a telephone system with no phone book.

ReplyQuote
Posted : 12/01/2010 1:31 am
Page 1 / 3
Share: