2

Possible Duplicate:
Where do deleted items go on the hard drive?

I've heard several times that when you delete a file, even after removing it from the Recycle Bin, it is still permanently stored on your computer and can be accessed by the likes of police professionals if needed. How does this work without effecting disk space?

1

4 Answers 4

4

This data isnt stored strictly speaking.

What happens when you delete isnt EXACTLY the computer going and wiping all the data out. What actually happens is that the computer forgets that that file exists(delete file system entry for that file). This means that if another file comes in that needs harddisk space, it might be stored over the old file. If this does not happen, several tools can scan the hard disks to undelete such files.

You can try this yourself by googling undelete. You will get many tools which will be able to recover deleted files.

This is why, when trying to securely delete files, people use specialized tools which actually go over every bit of hard disk space used to store those files and fill it with all 0s or random junk.

You can find more info at http://www.howtogeek.com/72130/learn-how-to-securely-delete-files-in-windows/

2

A good way to think of it is as a library. We have a set of index cards (the file table) relating to the books (files) on a shelves (clusters). If you need a file, you look up the index, go to the right place and get it. When a file is 'deleted' the index of the cluster is marked as 'deleted' but the actual file is still there. When the 'shelf' is full, the system looks at the file table, finds a location thats marked as deleted and overwrites it. This saves on writes. The actual file, or parts of it is not overwritten till the space is needed - which makes it recoverable.

The computer ignores 'deleted' files when calculating space since, well, as far as its concerned, there's nothing important there.

A 'secure' deletion is simply overwriting the area with zeros or random information.

2

Doing a single pass will erase your data pretty well. Most software won't be able to recover any metadata from that file, such as creation/modification timestamp and filename. However, it will restore the data in the file itself.

Doing three passes is considered Department of Education 'secure'. Anything over 10 passes is Department of Defense 'secure'.

Consumer grade file recovery typically won't read anything that is DOE secure.

Breaking the media itself is also an alternative. However, make sure you do it environmentally safe :p

0

What it does is tell the manager that the space that was occupied by the file can be re-used. So, until something is actually written to that specific space - the data is technically still on the disk.

That is why you can quick format a drive, it just does a pass saying you can use it all.

Whereas writing 0's to the disk overwrites the data once. Not gone, but closer. The best way to fully get it is repeatedly write over it (write zeros more than once).

Not the answer you're looking for? Browse other questions tagged .