You select a file and press Delete, and it disappears. But what actually happens to the file? Does it vanish or get erased from the disk permanently? If you are an advanced Windows user, you know for sure it’s quite the contrary.
There are several reasons why it’s worth considering this issue. The first one is that even when a file is removed accidentally from the computer or it is lost after a virus attack, you should know that there are high chances to recover it. The second reason is that if you can recover any deleted file on your won, then any other user who can get access to your PC will be able to do the same – which might be a serious problem.
YouTube:
What happens when you delete a file?
In case of conventional hard disks (HDD)
When a file is deleted, it is sent to the Recycle Bin, that is, when you press the button Delete on your keyboard, the file is just marked as deleted and the shortcut to such file appears in the Recycle Bin directory. By default, the Recycle Bin is enabled when you install any version of Windows, and it is enabled for every local disk connected to your PC. To disable the Recycle Bin, right-click on its desktop shortcut and select Properties. Choose each disk on the list and check the option Don’t move files to the Recycle Bin. Remove files immediately when deleted, then click Apply.
Recycle Bin is a very useful integrated feature in Windows. It allows you to restore deleted files and folders if you removed them by accident or if you need them some time after deleting. But what happens when you empty the Recycle Bin, that is, delete files permanently? In fact, nothing happens – nothing at all! The files are neither deleted from the disk nor moved elsewhere. The only thing that happens is updating a certain file in the operating system which says that the disk space allocated for the deleted files is now marked as free and any information can be written there – and overwrite the old data.
This file used by conventional hard disks is known as Master File Table (MFT), and looks like this.
The first column on the left displays blocks of addresses. The middle column shows data in the hexadecimal code (also known as HEX). The column on the right presents the way this data looks as simple text.
Therefore, the deleted file will be stored in the hard disk until the operating system overwrites this area with new data. The time required for this to happen can be quite long – up to a few months, but basically, it depends on the total size of your hard disk, on how you use your computer, and on what kind of local disk the old data is stored in. Data in the system disk (by default, it’s С:) can be overwritten very soon, even within several minutes, As Windows writes new temporary data to disk all the time: system cache, program cache, web cache and so on.
Let’s illustrate it with the example: we’ll use an app called NTFSWalker to scan any NTFS partition on a hard disk. The left column displays the list of files the app could find on the disk. The red letter X marks the MFT addresses which have been overwritten completely or partially, and the lines without such letter represent the addresses that have not been overwritten yet. In the right column, you can see additional information, including what specific data is written at this address. Now the problem of deleting files in an ordinary way becomes more obvious.
In case of solid-state drives (SSD)
Things are a bit different for SSDs. As solid-state drives are different from conventional HDDS in terms of technology, SSDs always write and move written data according to a special scheme so all physical memory of the storage device is used uniformly and proportionally. This standard feature allows to extend the SSD lifespan considerably by suggesting rational use of the read/write cycles – the guaranteed number of which is limited. This way, all memory blocks will be worn out evenly, and the risk of separate blocks to get out of order is reduced.
Therefore, if you delete a file with the address 2871 (for example), the deleted data may be relocated to another area on the disk sooner or later, until the SSD’s electronic brain decides to overwrite it. So how can you overwrite the unnecessary files for sure? In fact, it’s next to impossible to erase a specific file completely on an SSD. A group of engineers at the University of California, San Diego studied this topic and witnessed first-hand that completely erasing data from an SSD is very difficult. In an attempt to erase one file reliably, the disk actually retained from 4% to 75% of the file’s internal data. So my advice is to make sure you have encrypted your SSD and find out if your disk supports the TRIM feature.
Actually, this problem is not too relevant for most users, but at the same time, you might be worried that hackers may get their hand on the data deleted from your disk. It’s quite possible you deal with secret or sensitive data, documents containing trade secrets, or just store your personal banking data openly. So how could you remove this information reliably so that it doesn’t fall into the wrong hands?
Is that safe?
Before learning how to safely erase data from an SSD, let’s find out what exactly it means to you. That is, if you are satisfied with the current level of safety, it is going to be safe. If the data you don’t want to be restored is not of vital importance and can’t be used against you, then delete it in the standard way and don’t worry. Yet if you remove some banking data, work documents or data required for online authentication, it’s preferable to remove such files in a way that makes their recovery without your knowledge impossible.
Now let’s have a closer look at some methods of safe – and not too safe – file removal in Windows. Until we have reached the part for full removal / full erase of the entire disk space, these methods only apply to conventional HDDs.
The most dangerous method
The easiest and most dangerous method of removing files is to select a specific file or files and press Delete on the keyboard. It will send the file to the Recycle Bin, right-click on the Recycle Bin shortcut, and select Empty Recycle Bin from the context menu. As I said before, the disk area occupied by this file will be marked as empty and ready for new data, but the actual contents of the file are still there on the disk and it can be restored easily. With this method, you can get rid of all types of files that are of no value to you: system cache, browser cache, unnecessary apps and updates, temporary files and so on.
For example, you want to delete several photos. Go to the corresponding directory, select the files and remove them.
Then download from the official website hetmanrecovery.com a free trial version of the easiest data recovery program, Hetman Uneraser. Install it and scan the required disk – in my case, that is disk D:.
In the window that opens, browse for the folder – in my case, its name is Test. Here you are! You can see the list of deleted photos, and click on each one for preview. The only thing left to do is to select the files and click Recovery, then save them to a different storage device.
Somewhat dangerous method (for conventional HDDs only)
As I said earlier in this article, physically overwriting data with some other information is quite a good method of truly removing old files. This can be done with specialized software that will reliably overwrite the disk space occupied by a file with some random data. When trying to use a data recovery tool, hackers will be able to view the file name but its contents will be lost forever. This way, you can remove both separate files and entire directories.
Such utilities may look very different, but they employ the same procedure – delete the old file and overwrite its location with zeroes or random values. Software tools of this kind can guarantee a higher degree of safety if compared with the standard removal scheme. The only problem is you have to always use such tools when removing important files. Yet too often, users forget about it and remove important information in an ordinary way.
For example, I moved several photos to a folder named Test2 and now I’d like to remove them permanently. I need to download a specialized program, for example, Mareew Free Erazer. Install and launch it, find the required directory on the left and select the file to remove. Click Delete File.
Top comments (0)