How do file deletion and recovery work on NTFS Windows systems?

File deletion in NTFS only modifies the Master File Table (MFT) entry, marking the file as deleted without erasing the actual data clusters. Recovery is possible by restoring the MFT record, as long as the file's data hasn't been overwritten. This principle is detailed in the article Penetration Techniques - File Recovery and Deletion in Windows Systems. Tools like WinHex can visualize the MFT changes before and after deletion.