0

If a file is deleted in memory which is using NTFS and after that, I copied a new file, then where is the new file is allocated in memory?

Is the file allocated in the deleted memory space or it is allocated randomly?

note: both the deleted file and new file have the same size

closed as off-topic by forest, schroeder Feb 20 at 10:43

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • When you say "memory", do you mean RAM or the hard drive? – schroeder Feb 20 at 9:40
1

If a cached file is deleted and a new file is copied, both the files' contents remain in the filesystem cache. This is because most filesystem caches use the Least Recently Used (LRU) policy. From Wikipedia:

Discards the least recently used items first. This algorithm requires keeping track of what was used when, which is expensive if one wants to make sure the algorithm always discards the least recently used item. General implementations of this technique require keeping "age bits" for cache-lines and track the "Least Recently Used" cache-line based on age-bits. In such an implementation, every time a cache-line is used, the age of all other cache-lines changes.

When accessing caching the files A, B, C, D, E, D, and F on a system with room for four files shows the following access pattern when using LRU. A filesystem cache has room for far more than four files.

LRU

Not the answer you're looking for? Browse other questions tagged or ask your own question.