Why can you undelete files in Windows 7?

• A. The data is encrypted when deleted
• B. The files are moved to Recycle Bin
• C. Nothing is deleted; it is just removed from MFT
• D. The OS makes automatic backups

Answer: (C)

In NTFS, deleting a file is a metadata operation, not an immediate data wipe. When you delete, Windows marks the file’s MFT (Master File Table) entry as deleted and marks the space its data occupies as available, but the actual data blocks usually stay on disk until new data is written over them. Because the file’s content can remain intact until that overwrite happens, undelete tools can often recover the file by locating the now-unreferenced data and reconstructing it. The Recycle Bin is a separate mechanism that can store deleted items, but undelete is possible even when data wasn’t moved to the Recycle Bin, for the same underlying reason: the data remains until overwritten. Encryption would prevent recovery by making the data unreadable, and automatic backups are a separate process unrelated to the basic ability to undelete.