I use the analogy of a video cassette.
When you write to a file it's like recording a video and writing a label on the case, e.g. "Die Hard 3".
When a file is deleted, the label on the case is removed. The video is still there and you can still view it, you just have to know where it starts.
If you overwrite the deleted file its like recording over the video. Your label may say "House episode 7" but you can still see that "Die Hard 3" was on there and recover a large amount of it.
I use the analogy of a video cassette.
When you write to a file it's like recording a video and writing a label on the case, e.g. "Die Hard 3".
When a file is deleted, the label on the case is removed. The video is still there and you can still view it, you just have to know where it starts.
If you overwrite the deleted file its like recording over the video. Your label may say "House episode 7" but you can still see that "Die Hard 3" was on there and recover a large amount of it.
This is a good analogy for explaining slack space.
I use the analogy that jaclaz used. It is like a book with an index. When a file is deleted the index entry is erased, notifying the author that they can write on that page again. Until they write on it again, the old text is still there.
I also describe in simple terms deleting is like throwing away the telephone directory. You can reconstruct it by phoning every number and asking who is there.
No you cannot. (
Everybody LIES.
I don't ask why patients lie, I just assume they all do.
It's a basic truth of the human condition that everybody lies. The only variable is about what.
Seriously, just imagine that someone calls your home and asks for your name and address….
wink
jaclaz
I will defend my telephone analogy!
In data carving a raw disk image, one looks at every sector. Some sectors will start say 0xff 0xd8 and you can start saying that it is a JPEG. Others will start 'MZ' and you can say it is an EXE or DLL.
Some will look like text, others compressed data. Many will have no distinct pattern and so tell you nothing. In otherwords, some will tell you the truth, and some will tell you nothing, or just confuse you.
However you get the information back, deleted files are like a telephone system with no phone book.
I think the original post wanted to get an example of a simple explanation of how a file is deleted…
You should have said you'd defend your telephone analog
I will defend my telephone analogy!
In data carving a raw disk image, one looks at every sector. Some sectors will start say 0xff 0xd8 and you can start saying that it is a JPEG. Others will start 'MZ' and you can say it is an EXE or DLL.
Some will look like text, others compressed data. Many will have no distinct pattern and so tell you nothing. In otherwords, some will tell you the truth, and some will tell you nothing, or just confuse you.
However you get the information back, deleted files are like a telephone system with no phone book.
I will defend my telephone analogy!
Sure, the analogy is allright. D
It was the suggested recovery process for the deleted info that seems a bit shaky and not really feasible in practice (file fragments however tend to lie a lot less than people). wink
jaclaz
I have used a hotel analogy, with guests checking in, leaving their briefcase behind when they check out, etc. So in the hotel directory, "Smith's Room" goes into the pool of "Available Rooms" when Smith checks out, but it isn't an "empty room" because it still contains Smith's briefcase (data).
Since this hotel has a lazy housecleaning staff, the briefcase remains there until the room is reassigned, at which time the new guest discovers it and throws it down the hotel's trash chute to make room for his own stuff. Once it goes down the chute, it goes straight into the incinerator and is lost forever unless some fragments of it don't burn up completely, which often happens. On the other hand, if the briefcase happens to be discovered by the staff at any time before a new guest throws it down the chute, it can be examined to determine ownership, whether it contains valuables that should go into the hotel safe, etc. If Smith is suspected of a crime, the police might seize the briefcase and examine its contents for evidence…or sift through the hotel's ash heap for unburned fragments if the briefcase was unfortunately incinerated.
I'm sure you can see how to extend/embellish the analogy from there…
Not perfect, of course, but as analogies go, it's useful and understandable.
I would have said the number of analogies here is analogous to the number of stars in the sky…
(We do have a lot of light pollution where I live).
Paul