48

Correct me if I'm wrong here, but when you "delete" something from your PC all your computer does is write over some of the binary with 0's replacing the 1's. (Or something to that effect) So when you send something to the recycle bin it writes over part of the file, and when you delete from the recycle bin it writes more?

  • 11
    Securitywise, ordinarily deleted files are recoverable partially or fully depending on the extent of overwrite. If you need to erase file data such that it's unrecoverable, you will need to use third party tools to "securely delete" the file and/or "securely erase" the disk free space. This involves writing zeros or random data once or many times over the space and it's time consuming (that's why the ordinary delete doesn't do it). – ADTC Sep 28 '14 at 1:36
  • @JaDogg What do you mean? – Paracosmiste Sep 29 '14 at 15:12
  • @JaDogg most of the 0/1 and what is it? A/F? Not sure, a bit rusty. But it all pertained to networking. The majority of it anyways. I'm new here so I can't comment on the other people posting questions about it as I haven't seen anyone else, but I don't doubt it. – Shea A. Sep 29 '14 at 15:37
  • You're wrong. When you "delete" something, Windows just moves it to the Recycle Bin, which is, basically, just a special folder. Even when you delete something from the Recycle Bin, it generally isn't overwritten immediately. (But the blocks become free to be allocated to other files, and then the data can be overwritten.) – G-Man Oct 9 '14 at 22:36
  • @ADTC, It's just a normal write isn't it? So why do you need third party programs? If I resave the file as 000000000000 or random_garbage_data_repeat_random_garbage_dat before deleting, wouldn't that have the same effect? – Pacerier Jul 9 '15 at 5:01
86

Neither operation writes over the file.

Moving a file to the Recycle Bin does just that – moves the file, and it is the same as any other "move" operation when the new folder is on the same disk: the filename entry is moved from its original folder to another, but the file's content is still on the disk and is not physically moved, modified or even looked at.

Deleting a file from the Recycle Bin (or deleting it directly using Shift+Delete) removes the filename entry from its folder. The part of the disk previously occupied by the file is still not modified or overwritten and still contains all the file data, but that data is no longer linked to a filename. That spot of the disk is recorded as "free", however, so future writes to the disk can reuse that space, and if you keep using the disk the space will almost certainly be overwritten eventually.

In the case that you need to prevent recovery of deleted data, special tools exist to overwrite the data securely. That is not done by default because it is slow and increases wear on the disk.

  • 33
    To expand on the "moving a file" bit, the Recycle Bin is just an ordinary folder on your hard drive that Windows shows to you in a special way. – Mark Sep 27 '14 at 19:54
  • 9
    @Mark not quite, I believe - there's a 'recycle bin' folder on every drive (is it .$TRASHES? can't remember), and Windows combines all of them when you open the Recycle Bin. So your C: drive and E: drive both have a folder, because Windows doesn't want to copy everything when you delete it (that's the whole point!). – Riking Sep 28 '14 at 5:39
  • 7
    Windows Vista, 7, and 8 (and 8.1) use $RECYCLE.BIN. @Riking You're thinking of Nautilus for Linux; it uses .Trashes. – Cole Johnson Sep 29 '14 at 3:52
  • 3
    Although it's file-system dependent, file names are not usually removed from the folder upon deletion. e.g. in FAT/FAT32 just the first character of the filename in the dirent is replaced with an 0xE0 byte making the entire file including all but the first character of the name entirely recoverable if no writes have taken place that reuse the cluster chain that was previously allocated to the deleted file. – Andy Brown Sep 29 '14 at 7:58
  • 6
    @Yaitzme moving a file does not generally move the contents of a file. If the source and destination are on the same partition, only the name of the file is moved (i.e. a pointer to the file is added to the new directory, and deleted from the old directory). The data can stay in the same place. Only when you move a file across partitions do you need to copy all the contents. – amon Sep 29 '14 at 8:52
36

A file is in two parts:

  1. A directory entry which records the file name and also contains a list of the blocks on disk which contain the data contents of the file. The operating system then "knows" that these blocks are in use.
  2. The actual blocks which contain the data contents of the file

When a file is deleted:

  1. The list of blocks in the directory entry are returned to the operating system marked as free. The directory entry is deleted, so the file "disappears" from the file system.
  2. The actual blocks are not touched, so the data contents of the file remain untouched until some other new file overwrites them. This is the reason that file recovery software can often rebuild deleted files (but only if it is used soon after deletion).
10

You need to clarify if you are asking what happens on the physical drive, or on the software level.

On the physical side, it depends on the drive:

  • On magnetic drives, overwriting bits, or writing them, is the same operation, so files usually don't get physically deleted (the operating system just changes the table of content of the partition and mark the space as free).

  • On SSD drives, it is not possible to write over existing data so files usually get physically deleted (See http://en.wikipedia.org/wiki/Trim_(computing) )

On the software, depends on the filesystem you are using, most of the time, only the table of content of the partition is changed.

  • 4
    "Moving to the Recycle Bin moves the file." Not really. The file itself doesn't move; it still occupies the same LBAs on the disk as it did before. Even the file record is the same. The only thing "moved" is the directory entry, from the file's original directory to the directory for the "Recycle Bin". – Jamie Hanrahan Sep 28 '14 at 0:30
  • That thing about SSD is something I didn't expect. I thought all write operations in an SSD cause wear. Doesn't trim cause wear? You may want to mention that it's not the OS actively writing zeros on the space but just sending a trim command to the SSD which in turn clears the data from the sectors that held the file. – ADTC Sep 28 '14 at 1:29
  • what i wanted to say, but did not take the time to explain is that when asking this type of questions, you really need to narrow it down to either the software or hardware side of things. "files", "folders", "partitions", "table of content" etc all are software concepts. On the hardware side it's more like "read 80 bytes at address 0x2384923, "write 24 bytes at address 0x123123" or "trim 292 bytes at address 0x82478923" – Eloims Sep 28 '14 at 11:52
  • 6
    AFAIK, The Trim command does not delete the file physically (as ADTC mentioned, this would be a costly operation. It just lets the drive's firmware know that it doesn't have to preserve the data anymore. So this is conceptually quite similar to what happens at the filesystem, just at the firmware level. – oefe Sep 28 '14 at 12:04
  • 2
    When the number of blank pages gets low enough, an SSD will search for a block which contains nothing but "obsolete" pages. If such a block is found, it will be deleted. Otherwise it will find the block that contains the most obsolete pages, copy a non-obsolete page to a remaining blank one, and mark the page as obsolete. Once this is done for all blocks on a page, that page will no longer contain any non-obsolete blocks and may thus be reclaimed. Note that if a file system thinks a page is useless, but the drive doesn't know that, it may waste time copying useless data. – supercat Sep 28 '14 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.