Windows automatically keeps an index of what was deleted and when.
It is kept in the Recycle Bin.
 
When the Recycle Bin is emptied, the INFO2 record is deleted.
We run special scripts to find any and all INFO2 records or pieces of records.
 
 
Naming convention:
Before deletion:   letters.doc
After deletion:   dc241.doc
 
(d for deleted, c for the file coming from the c partition, and then
an arbitrary number, then the file extension assigned to the file)

- Return to FAQ -