Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Why do people say that nothing is ever truly deleted?

Let's say I have a byte in my hard drive that contains the byte 0x00. If I overwrite it with the byte 0x01, how can anyone ever know that it ever contained the byte 0x00?

share|improve this question

migrated from stackoverflow.com Dec 12 '11 at 1:18

This question came from our site for professional and enthusiast programmers.

closed as not constructive by DragonLord, Ƭᴇcʜιᴇ007, Nifle, ChrisF, studiohack Jan 8 '12 at 0:11

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Hard drives are mechanical devices. The write head won't write at exactly the same spot, there is always some mis-alignment. –  Hans Passant Dec 11 '11 at 19:40
    
It's only deleted when the guys in the black helicopters say it's deleted. –  Daniel R Hicks Dec 12 '11 at 1:52

5 Answers 5

up vote 3 down vote accepted

I don't think they can, if you actually overwrite that area of the hard drive with the magnetic field value corresponding to 0x01 enough times. However, that's not how operating systems work. Operating Systems store a series of file pointers that map to the location of file on the physical disk. When you delete a file, you remove this file pointer, but you do not overwrite the disk at that point.

There are programs that bypass this and write values to the physical chunks of your hard drive thus changing the strength of the field at that chunk. This eliminates the previous value.

I could be incorrect, but there might be statistical methods to retrieve what was probably the value at that chunk, but as I said, I am unsure.

share|improve this answer
    
I think the "probably" part of your statement is true. Based on the strength of the magnetism, you can possibly determine what the previous stored bit was, and with a very large probability of error, the one before that. –  rockerest Dec 11 '11 at 19:22
    
I do have a document somewhere that tested the overwriting hypotheses, essentially, once the data is overwritten, even just once, then it is extremely hard to retrieve the previous information. Even if you do manage to retrieve something, the analysis would have made some statistical guesses so it would not even be reliable enough to be legally admissible. –  Hydaral Dec 12 '11 at 2:45
    
I found the document, here is a quote: "What we found from this is that even on a single write the overlap at best gives a probability of as low as just over 50% of choosing a prior bit (the best read being a little over 56%)." So Magnetic Force Microscopy on the disk after a single overwrite is only just better than guessing, and that's just for a single bit, let alone multiple bytes. Ref: bandwidthco.com/whitepapers/compforensics/datarecovery/… –  Hydaral Dec 12 '11 at 2:50

In addition to what other people are saying, SSDs make this more interesting.

When you write to a specific location on an SSD, you're not necessarily always writing to the same place. This is done to avoid problems with memory cells wearing out if a particular location is written lots of times. The writes are distributed across the whole disk by copying the old sector and modifying when it's written to the new location. A side effect is that there are old copies of data left lying around. A user, programmer, or even OS has knowledge of this, and can't control it. It's all done in the controller chip on the SSD.

Some modern filesystems do similar things (Copy on Write or CoW), but there it's the OS that has the knowledge of what old data might be available.

share|improve this answer

There are also people (Peter Gutmann) who believe that it's theoretically possible to recover, using certain magnetic techniques, data that's been previously overwritten. Although it doesn't seem practical, there's several forensic data recovery services that claim to be able to, at least to some extent, extract data that's been overwritten.

More about his stuff here: http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html and http://www.cypherpunks.to/~peter/usenix01.pdf

share|improve this answer

It's only truly deleted if the filesystem decides to later reclaim that unused address, otherwise the data is still there.

share|improve this answer

Because your filesystem is just an table with file id's and physical addresses which point to data for these entries. If you delete an file you just delete your entry but your data remain in the same place where it was before.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.