What Happens to Deleted Files?

People are always saying that when you delete a file, it never goes away. While that statement is accurate, it is not always true. So, what actually happens, when you click delete?

The most obvious example of files not being deleted is the recycle bin. On almost every operating system, there is some sort of trash can, which is essentially a folder, where files are shifted to once you press delete. You can recover deleted files from here, as long as you haven’t emptied it manually, or waited so long that the files deleted themselves. However, even if you “permanently” delete a file, it is still on your hard drive. The sector of your hard drive that the file previously inhabited has just been marked as empty…

An easier way to understand this is to think of your hard drive as a book. When your computer was turn for the first time, it produced a table of contents. This table of contents contains what are called pointers, which are what informs the computer where to look on the hard drive, for a certain set of data. When you delete a file, the part of the table of contents that are for that particular “chapter”, are erased. This means that the pages of that chapter are still there, but they are marked as empty, allowing people to write over them, if they so desire.

So, even when you permanently delete a file, the data for that file is still there. As long as your computer does not fabricate any new files, you could technically still retrieve that file. However, if any new files are created, that creates new pointers in the computer’s directory, which will most likely conflict with the old data, but since it has been marked as empty, the new file takes priority, and overwrites the deleted files.

This technique of writing over previously deleted files is also what causes files to become corrupted. Say you deleted an image that was 10MB, and then downloaded a new text file that was only 5MB. If you then used a data recovery tool to try and salvage the deleted file, it would probably appear something like this:

This happens because when the hard drive wrote over the original data, it only used half of the space that the original file had originally taken up. And, since the original data was never fully obliterated, some of the original image remained, while the other bits are the new file, converted to an image.

And this, the fear of being able to fully, or partially recover data, is why government services physically destroy their computers when they are done using them. However, just like paper, shredded hard drives can be put back together, piece by piece, to obtain the data. While the practice of un-shredding a hard drive is lengthy, and if you mess up the placement of one fragment, or even make an extremely small scratch one, it could possibly ruin the data, it is still possible.

 

• Uncategorized