Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm just curious. It seems that they should be but I googled the question and didn't get a straight answer. If you delete a file it only gets marked as free space on the hard drive and is easily recoverable (undeleted), so I hope it's not the case with archive files, that they remain encrypted after you delete them from the archive. Can you make it clear I'm not wrong on this one?

share|improve this question
    
Is it correct to refer to a not-unpacked-file as a file in this context? It seems like this misapprehension of the dual-meaning of the word file in the context of archives is at the heart of the OP's question. I think Kyle Jones' answer touches on this distinction: some (most?) archive tools will unpack and repack to edit the file list. Some can do this {with magic} without unpacking. The former delete the temp files (and are more easily recoverable in some form) the latter are probably less recoverable. –  horatio Mar 29 '12 at 20:04

3 Answers 3

The answer to your question depends on how the deletion was done.

If the RAR was unpacked and decrypted, a file was deleted from the unpacked directory, and then the directory was rolled back into an encrypted RAR, then the deleted file can be recovered.

If your deletion tool edited the RAR archive directly, modifying the unencrypted structural elements without ever decrypting the encrypted blocks, then the deleted file cannot be recovered since it was never unencrypted on disk.

share|improve this answer

If the file was encrypted when it was deleted then any recoverable data is still in encrypted form.

This assumes file-level encryption. The answer would be different for a plain file placed into an encrypted filesystem.

share|improve this answer

I agree with what RedGrittyBrick says in his post.

And if you are really paranoid about the possibility that someone can retrieve your file, you can use utility to permanently remove a file on a mechanical hard drive. For Windows, you can use Eraser. On Linux, you can use the 'shred' command.

Permanently deletion of file on Windows and Linux is only achieve if you are using a mechanical hard drive. Solid state drive and flash memory is based off a different architecture and therefore permanently deletion of a file might not be possible (at least not that I aware of).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.