23

After reading the quote below on the Casey Anthony trial (CNN) ,I am curious about where deleted files actually go on a hard drive, how they can be seen after being deleted, and to what extent the data can be recovered (fully, partially, etc).

"Earlier in the trial, experts testified that someone conducted the keyword searches on a desktop computer in the home Casey Anthony shared with her parents.

The searches were found in a portion of the computer's hard drive that indicated they had been deleted, Detective Sandra Osborne of the Orange County Sheriff's Office testified Wednesday in Anthony's capital murder trial."

I know some of the questions here on Super User address third party software that can used for this kind of thing, but I'm more interested in how this data can be seen after deletion, where it resides on the hard drive, etc. I find the whole topic intriguing, so any additional insight is welcome.

1
  • I was recently downloading some torrents and when I tried to preview them it played videos I had deleted several days earlier as it has assigned that memory location to the torrent but not yet downloaded anything. Thought an example might help :)
    – Skeith
    Jun 24, 2011 at 10:09

5 Answers 5

33

In general, deleted files don't go anywhere. They remain on the disk exactly as they were until they happen to get overwritten. When they are deleted, a link to it is simply removed from the file system structure.

39

Imagine a library in 1970. You had all the shelves with the books on them and you had drawers with cards that could tell you where the book you were looking for was located.

On a hard drive, you have a table (the drawers) that's separate from the files (the books).

Your operating system references this table when it needs to find data. It then goes to the location of the book with it's read head or whatever the device uses and reads the data there.

When a user decides to delete a file the computer just erases the contents of the table for that location, this basically puts a blank card for that file in the table. because it would take more time and power for the computer to go to each location and actually erase the file, it just leaves it there.

Then, because the book is still physically in the library, even though it's not on their records, it's possible for special software to read all of the books and find out what's recently been deleted (As long as it hasn't been written over since then!)

1
  • 1
    + 2 Very good analogy.
    – jerry
    Jun 25, 2011 at 13:45
5

It depends on what you mean by deleted. in most OSes, files are "deleted" by being moved to a Trash folder, specifically so they can be recovered later by the user. Once the Trash contents is "deleted", the blocks containing the data are marked as available, but with their contents intact. To make the data unreadable, the user must "Securely Delete" the file or the Trash folder containing it, if the OS offers that option. If not, those blocks will eventually get re-used and over-written by new data, but that could take a long time, and meanwhile, the data in those blocks could be found and read.

3
  • 1
    It should be noted that "deleting" and or "moving" a file from one folder to another or even into the trash only affects the file's link information (i.e. name) not the file's contents on disk.
    – Chris Nava
    Jun 23, 2011 at 21:25
  • @Chris is that why it is much faster to cut a larger file than copy it ?
    – Skeith
    Jun 24, 2011 at 10:13
  • 1
    Yes - moving a tiny link is much faster than copying the file's contents.
    – JRobert
    Jun 24, 2011 at 18:43
5

Tyler Faile's analogy is great.

The data doesn't go anywhere. The address of it is simply marked as free space, and is then overwritten when new data needs a place to go. As soon as it's overwritten then it is gone permanently.

If you want to delete something so that it won't be recoverable you can either directly overwrite it, or overwrite all the free space on your hard drive. You must be careful about simply overwriting files though, as files are moved around by the OS during normal use. If this happens the old copy won't be securely overwritten.

A good program for overwriting files, and overwriting all free space is Eraser. http://eraser.heidi.ie/

A good program for overwriting entire hard drives (perhaps before selling them) is Darik's Boot and Nuke. Be very careful with this program. Its name is quite accurate. Don't use it unless you are certain you don't want any data on a computer.

There are often debates about if data can still be recovered after a single overwrite. The fact is this has never been publicly done on a modern disk. Peter Gutmann wrote a paper about this, and one of the methods is named for him. You can read his paper here: http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html

This is what he has to say about multiple pass overkill:

In the time since this paper was published, some people have treated the 35-pass overwrite technique described in it more as a kind of voodoo incantation to banish evil spirits than the result of a technical analysis of drive encoding techniques. As a result, they advocate applying the voodoo to PRML and EPRML drives even though it will have no more effect than a simple scrubbing with random data. In fact performing the full 35-pass overwrite is pointless for any drive since it targets a blend of scenarios involving all types of (normally-used) encoding technology, which covers everything back to 30+-year-old MFM methods (if you don't understand that statement, re-read the paper). If you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, "A good scrubbing with random data will do about as well as can be expected". This was true in 1996, and is still true now.

3
  • 1
    It should be noted, though, that multiple overwriting may not be secure on SSD-Drives. Compare superuser.com/q/22238/33973 Jun 24, 2011 at 5:56
  • It should also be noted that overwriting individual files (as opposed to a whole partition/disk) is often not enough: superuser.com/questions/157931/foss-wipe-free-space-7-35-passes
    – sleske
    Jun 24, 2011 at 10:19
  • This is a good answer, but the OP wasn't interested in actual software that erases but where it resides, of which you provide no new insight. I didn't downvote, but can't really justify an upvote. Jul 8, 2011 at 16:27
3

The allocated space for deleted files is freed so other files could overwrite them. But until that happens your files remain on your hard drive.

Usually it is not possible to access these files but different tools exist to find such deleted but not yet overwritten files. Still you loose the whole meta information about the file like path and filename. If you restore such a file it gets a cryptic name like FILE004 in a specific directory.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .