Why do people say that nothing is ever truly deleted?
Let's say I have a byte in my hard drive that contains the byte 0x00. If I overwrite it with the byte 0x01, how can anyone ever know that it ever contained the byte 0x00?
2
-
Hard drives are mechanical devices. The write head won't write at exactly the same spot, there is always some mis-alignment.– Hans PassantDec 11, 2011 at 19:40
-
It's only deleted when the guys in the black helicopters say it's deleted.– Daniel R HicksDec 12, 2011 at 1:52
Add a comment
|
5 Answers
I don't think they can, if you actually overwrite that area of the hard drive with the magnetic field value corresponding to 0x01 enough times. However, that's not how operating systems work. Operating Systems store a series of file pointers that map to the location of file on the physical disk. When you delete a file, you remove this file pointer, but you do not overwrite the disk at that point.
There are programs that bypass this and write values to the physical chunks of your hard drive thus changing the strength of the field at that chunk. This eliminates the previous value.
I could be incorrect, but there might be statistical methods to retrieve what was probably the value at that chunk, but as I said, I am unsure.
-
I think the "probably" part of your statement is true. Based on the strength of the magnetism, you can possibly determine what the previous stored bit was, and with a very large probability of error, the one before that.– rockerestDec 11, 2011 at 19:22
-
I do have a document somewhere that tested the overwriting hypotheses, essentially, once the data is overwritten, even just once, then it is extremely hard to retrieve the previous information. Even if you do manage to retrieve something, the analysis would have made some statistical guesses so it would not even be reliable enough to be legally admissible.– HydaralDec 12, 2011 at 2:45
-
I found the document, here is a quote: "What we found from this is that even on a single write the overlap at best gives a probability of as low as just over 50% of choosing a prior bit (the best read being a little over 56%)." So Magnetic Force Microscopy on the disk after a single overwrite is only just better than guessing, and that's just for a single bit, let alone multiple bytes. Ref: bandwidthco.com/whitepapers/compforensics/datarecovery/…– HydaralDec 12, 2011 at 2:50
There are also people (Peter Gutmann) who believe that it's theoretically possible to recover, using certain magnetic techniques, data that's been previously overwritten. Although it doesn't seem practical, there's several forensic data recovery services that claim to be able to, at least to some extent, extract data that's been overwritten.
More about his stuff here: http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html and http://www.cypherpunks.to/~peter/usenix01.pdf
Because your filesystem is just an table with file id's and physical addresses which point to data for these entries. If you delete an file you just delete your entry but your data remain in the same place where it was before.
It's only truly deleted if the filesystem decides to later reclaim that unused address, otherwise the data is still there.
In addition to what other people are saying, SSDs make this more interesting.
When you write to a specific location on an SSD, you're not necessarily always writing to the same place. This is done to avoid problems with memory cells wearing out if a particular location is written lots of times. The writes are distributed across the whole disk by copying the old sector and modifying when it's written to the new location. A side effect is that there are old copies of data left lying around. A user, programmer, or even OS has knowledge of this, and can't control it. It's all done in the controller chip on the SSD.
Some modern filesystems do similar things (Copy on Write or CoW), but there it's the OS that has the knowledge of what old data might be available.
