If I delete a something from a zip file, can it still be recovered?
When creating a new archive file
I have this zipped folder. Before sending it to someone, I unzipped the folder then edited and deleted some files on it using my computer. Then after modifying it, I zipped it again then sent it to someone. Can they still recover the edited and deleted files?
If you create an archive anew, like in the example, then the new archive will not contain deleted files; neither will it contain old versions of the existing files.
When modifying an archive file
Your example with creating a new archive file is somewhat different than the title:
If I delete something from a zip file, can it still be recovered?
If you delete something directly from a zip file, it may or may not be recoverable.
ZIP as a format allows deleting entries just by updating the central directory at the end of the archive, without rebuilding the rest of the archive. Similarly one can append a new version of some existing file without touching the old data.
From Wikipedia (emphasis mine):
Because ZIP files may be appended to, only files specified in the central directory at the end of the file are valid. Scanning a ZIP file for local file headers is invalid (except in the case of corrupted archives), as the central directory may declare that some files have been deleted and other files have been updated.
For example, we may start with a ZIP file that contains files A, B and C. File B is then deleted and C updated. This may be achieved by just appending a new file C to the end of the original ZIP file and adding a new central directory that only lists file A and the new file C. When ZIP was first designed, transferring files by floppy disk was common, yet writing to disks was very time consuming. If you had a large zip file, possibly spanning multiple disks, and only needed to update a few files, rather than reading and re-writing all the files, it would be substantially faster to just read the old central directory, append the new files then append an updated central directory.
[…]
Tools that correctly read ZIP archives must scan for the end of central directory record signature, and then, as appropriate, the other, indicated, central directory records. They must not scan for entries from the top of the ZIP file, because (as previously mentioned in this section) only the central directory specifies where a file chunk starts and that it has not been deleted. Scanning could lead to false positives, as the format does not forbid other data to be between chunks, nor file data streams from containing such signatures. However, tools that attempt to recover data from damaged ZIP archives will most likely scan the archive for local file header signatures; […]
A tool that deletes an entry from a zip file can:
- only update the central directory; then the "removed" data is still in the archive and can be recovered
- or update the central directory and deliberately overwrite the relevant fragment with zeros, garbage or whatever, still without rewriting later parts of the archive; then the overwritten data cannot be recovered
- or truly remove the relevant fragment and rebuild (rewrite) everything that follows; then the removed data cannot be recovered
Here "recovered" means "recovered from the archive file alone", not "recovered from the filesystem/disk/memory/cache/…". You seem to be concerned if the person you send the archive file to can recover anything. If you send the archive to someone who has no access to your machine, the ability (if any) to recover anything from your filesystem/disk/memory/cache/… is irrelevant because it's your ability, not theirs.
It depends.
When you delete data from ZIP, it is (most likely) physically removed from the archive (in rare cases, the data is kept there). Then your zip file is replaced with its new version.
The difference is how various OS or filesystems treat scenarios when the file is overwritten. Some systems may write data to an entirely new location on the drive - in this case it may be possible to recover data by analyzing the whole drive by a recovery software. If the new version was written “directly into the same sectors”, then your data may be lost.
It is also worth checking File History (if it’s enabled) and various online drives - they often keep previous versions of files for some time.