1.5.1 How Files Can Be Recovered

When a file or directory is deleted from a FAT file system, the first letter of its file name is set to the sigma character (ASCII 0xE5). All of the information with the exception of the first character remains in tact.

A more devious method of hiding a file is to place the entry after a blank entry in a directory. Then, when an operating system reads the directory, it will stop reading the directory before reaching the hidden entry. This should not happen by default on DOS systems. For a file to be hidden in this fashion would require either special tools or manual directory manipulation.

In most cases, a deleted file can be recovered by simply copying the cluster chain that is referenced by the file entry.