They say when you delete a file, it isn't actually deleted....

Forums › Desktop computing › They say when you delete a file, it isn't actually deleted....

simon14

1889 posts

Uber Geek

Trusted

#101334 29-Apr-2012 10:49

They say when you delete a file, it isn't actually deleted....

How does this work?

Say I have a 500mb hard drive and it gets full so I delete 200mbs of data. I then put on another 200mb of data filling up the hard drive again to its max capacity of 500mbs.

How is it possible that the original 200mb of data I deleted earlier is not actually deleted? Where is it being stored as my hard drive capacity is full?

Doesn't make sense to me, can anyone kindly explain?

1 | 2 | 3

521 posts

Ultimate Geek

#616888 29-Apr-2012 11:05

What it means is when you delete something it marks it on the hard drive as being available space bu dosn't actually clear the data off. If a hard drive is truly full then none of the previous data is there anymore because it has all been replaced with new data. When you delete something it is still there hiding away until it is manually wiped clean or something takes its place.

Hope this makes sense.

PC: 3.3ghz Core i5-2500, 8gb DDR3, ATI Radeon 5850, 27" QHD IPS Monitor

Mobile Phone: iPhone 5 32gb Graphite.

Gadgetcity

26 posts

Geek

#616889 29-Apr-2012 11:08

When you delete a file it is not actually deleted. Only the reference to the data is deleted and that area of the hard drive is now free for re-use. In your scenario the deleted data would be overwritten by the new data you are writing.

This means that data is never deleted. It only ever gets overwritten (by another file or by formatting).

If you are worried about leaving data behind e.g. removing personal data when you sell a PC, then the are "secure deletion" programs out there. They simply overwrite the data several times to make sure it can't be recovered.

gzt

17104 posts

Uber Geek

Lifetime subscriber

#616930 29-Apr-2012 13:05

simon14: <snip> How does this work? Say I have a 500mb hard drive and it gets full so I delete 200mbs of data. I then put on another 200mb of data filling up the hard drive again to its max capacity of 500mbs. How is it possible that the original 200mb of data I deleted earlier is not actually deleted? Where is it being stored as my hard drive capacity is full?<snip>

If your description is accurate - maybe you just need to empty your recycle bin. I forget exactly but IIRC windows effectively has a recycle bin on each drive. The disk clean up tool on the disk properties tab has some additional things you might want to look at as well.

freitasm

BDFL - Memuneh
79252 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#616941 29-Apr-2012 13:14

As said previously, a file is marked as deleted in the directory space, and the system knows to reuse those sectors. This is much faster than actually writing over the existing data.

If you want to wipe out your drive before sending out to someone you need to use a program that will use different techniques - writing over the data multiple times, using different patterns, etc. This might take hours.

I have just removed the storage from my home server for sale, and it takes about four hours for a program to clean one 500GB drive. I have five of those, plus a 1TB drive - spent a few hours having this done but it's the only way to ensure no one can easily recover any of my data from those drives.

Or you can just get a drill, put some holes into the drive, then use a hammer to destroy the plates and set them on fire...

mattwnz

20141 posts

Uber Geek

#616945 29-Apr-2012 13:17

freitasm: As said previously, a file is marked as deleted in the directory space, and the system knows to reuse those sectors. This is much faster than actually writing over the existing data.

If you want to wipe out your drive before sending out to someone you need to use a program that will use different techniques - writing over the data multiple times, using different patterns, etc. This might take hours.

I have just removed the storage from my home server for sale, and it takes about four hours for a program to clean one 500GB drive. I have five of those, plus a 1TB drive - spent a few hours having this done but it's the only way to ensure no one can easily recover any of my data from those drives.

Or you can just get a drill, put some holes into the drive, then use a hammer to destroy the plates and set them on fire...

The other way around it could be to always have all your data encrypted on the drive.

Elpie

1304 posts

Uber Geek

#616946 29-Apr-2012 13:18

gzt:
simon14: How does this work? Say I have a 500mb hard drive and it gets full so I delete 200mbs of data. I then put on another 200mb of data filling up the hard drive again to its max capacity of 500mbs. How is it possible that the original 200mb of data I deleted earlier is not actually deleted? Where is it being stored as my hard drive capacity is full?

If your description is accurate - maybe you just need to empty your recycle bin. I forget exactly but IIRC windows effectively has a recycle bin on each drive. The disk clean up tool on the disk properties tab has some additional things you might want to look at as well.

Just a note - the Windows Recycle Bin doesn't delete the file. Overwriting it will make the file unrecoverable but until that space is completely overwritten (generally, several times) traces of it remain. If you really want to see what gets left for recovery then grab some recovery software and have a look at your system. What you see in Windows and what is hiding out of sight can be quite illuminating ;)

simon14

1889 posts

Uber Geek

Trusted

#617034 29-Apr-2012 17:33

Thanks guys, I learnt something today!

freitasm:
Or you can just get a drill, put some holes into the drive, then use a hammer to destroy the plates and set them on fire...

I like this method :)

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

SteveON

1916 posts

Uber Geek

#617039 29-Apr-2012 17:46

simon14: Thanks guys, I learnt something today!

freitasm:
Or you can just get a drill, put some holes into the drive, then use a hammer to destroy the plates and set them on fire...

I like this method :)

Done this before, was fun!

qwerty7

434 posts

Ultimate Geek
Inactive user

#617274 30-Apr-2012 10:08

yes as above it is not actually deleted just marked as 'free' and then gets over written.

That is why if you accidentally delete something important which is not stored in the recycle bin the best thing to do is stop using the computer as a system takes over this free space quickly with temporary files etc

The wipe free space option in c-cleaner does exactly as the name suggest.

bazzer

3438 posts

Uber Geek

Trusted

#617308 30-Apr-2012 10:48

freitasm: As said previously, a file is marked as deleted in the directory space, and the system knows to reuse those sectors. This is much faster than actually writing over the existing data.

If you want to wipe out your drive before sending out to someone you need to use a program that will use different techniques - writing over the data multiple times, using different patterns, etc. This might take hours.

I have just removed the storage from my home server for sale, and it takes about four hours for a program to clean one 500GB drive. I have five of those, plus a 1TB drive - spent a few hours having this done but it's the only way to ensure no one can easily recover any of my data from those drives.

Or you can just get a drill, put some holes into the drive, then use a hammer to destroy the plates and set them on fire...

What I've never understood is why, if once the file is marked as deleted and then overwritten it's lost for good, these programs need to write over the data multiple times to ensure it's safe. I can understand that maybe if the drive was 010101010101 and it was overwritten with 0000000000000 that the 1s might leave some residual information, but not enough to be recoverable by anything beneath forensic level surely?

simon14

1889 posts

Uber Geek

Trusted

#617326 30-Apr-2012 11:12

What about doing a format? Surely that will get rid of all data?

trig42

5809 posts

Uber Geek

ID Verified

#617333 30-Apr-2012 11:20

simon14: What about doing a format? Surely that will get rid of all data?

No, generally it won't. A format will just erase and recreate the file allocation table, meaning the PC sees a blank drive, much like deleting a file.

There are secure formats, but they will take ages.

freitasm

BDFL - Memuneh
79252 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#617335 30-Apr-2012 11:22

simon14: What about doing a format? Surely that will get rid of all data?

It won't.

ChevronX

280 posts

Ultimate Geek

#617361 30-Apr-2012 11:49

trig42:
simon14: What about doing a format? Surely that will get rid of all data?

No, generally it won't. A format will just erase and recreate the file allocation table, meaning the PC sees a blank drive, much like deleting a file.

There are secure formats, but they will take ages.

Nope but you can use a program called Shred to keep writing, deleting, writing and overwrite the information several times, but to be certain that most of your data is actually deleted you need to do about 20 passes and it takes awhile (hours).

"The Atlantis base, brings greetings from the pegasus galaxy, you may cut power to the gate!."- Dr Weir (Rising) New Zealand · Luke.Geek.NZ

freitasm

BDFL - Memuneh
79252 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#617365 30-Apr-2012 11:51

I use Acronis Drive Cleanser. The US DoD algorythm takes about five hours to clean a 500GB drive with four passes.

1 | 2 | 3