Microsoft included a similar UNDELETE program in versions 5.0 to 6.22 of MS-DOS, but applied the Recycle Bin approach instead in later operating systems using FAT.
DR DOS 6.0 and higher support UNDELETE as well, but optionally offer additional protection utilizing the FAT snapshot utility DISKMAP and the resident DELWATCH deletion tracking component, which actively maintains deleted files' date and time stamps and keeps the contents of deleted files from being overwritten unless running out of disk space.
Since Novell DOS 7 the kernel will store the first letter of deleted files in the directory entries in order to further assist undeletion tools in recovering the original name.
[11] Graphical user environments often take a different approach to undeletion, instead using a "holding area" for files to be deleted.
This approach is used by the Trash can in Macintosh operating systems and by the recycle bin in Microsoft Windows.
In case of FAT32, it is additionally erased field responsible for upper 16 bits of file start cluster value.
When undeletion operation is attempted, the following conditions must be met for a successful recovery of the file: Chances of recovering deleted files is often higher on FAT12 and FAT16 as compared to FAT32 volumes due to the typically larger cluster sizes used by the former systems and due to loss of upper 16 bits of logical cluster address for FAT32.
Until the MFT entry is reused or overwritten, the file can be easily recovered: data recovery software can find the "lost" MFT entry and derive full information about the lost file from it.
Data erasure is a term that refers to software-based methods of preventing file undeletion.