A rather theoretical question: Assuming there is memory with a malware inside it. The malware's goal is to detect if a legit application is about to delete contents of the memory.
If recognized, the malware would copy parts, which are not deleted yet, to other locations, which already have been deleted and thus effectively reverse the deletion process.
My questions are: how could a malware notice that a delete operation was initiated. And could the malware somehow recognize the addresses of the deletion process?
Of one considers deletion in terms of overwriting existing memory with a constant value (0 or 1), deleting a big file should lower the entropy of the memory contents. However, I believe this is not a reasonable approach.