73. Deleting from Command Prompt

• When a file is deleted at the command prompt,

  1. The file does not go into the Recycle Bin.

  2. Part of the file or the complete file can be recovered using forensic tools.

• Tasks performed by the operating system (also when a file is permanently deleted from the Recycle Bin):

  • The clusters are made available for new data.

  • The MFT attribute $BITMAP is updated.

  • File attributes of the MFT are marked as available.

  • Any connections to the inodes and VFN/LCN cluster locations are removed.

  • The list of links to the cluster locations is deleted.