When a file is deleted from a computer or device, many people assume the data is gone forever. However, that is often not the case. Deleted data can frequently be recovered using data recovery software or forensic analysis. So is deleted data really gone forever? Let’s take a closer look.
What happens when you delete a file?
When you delete a file on your computer or device, the operating system does not immediately remove the data from the storage device. Instead, it marks the space occupied by that file as being available for new data. The actual contents of the deleted file remain on the storage device until that space is overwritten by new files.
This is because storage devices like hard drives and SSDs work by breaking up space into small chunks called blocks. Each block can store a portion of a file. When you delete a file, the links to those blocks are removed from the file system index, but the contents of the blocks remain untouched.
So until new data overwrites the blocks, the original deleted file data is still present. This allows deleted files to often be recovered using data recovery software, even if you emptied the Recycle Bin or Trash folder.
When is deleted data overwritten?
Overwriting depends heavily on how much activity there is on the storage device. If you delete a file and then continue to use the device for downloading, saving, or installing, the deleted data has a high chance of getting overwritten relatively quickly as blocks are required for the new data.
However, if the device is left idle after files are deleted, there is less new activity to trigger overwriting. So in that case, deleted files may persist for much longer before getting overwritten.
The more storage space is available, the longer it takes to overwrite deleted data. For example, deleting files from a nearly full hard drive will cause those blocks to be reallocated almost immediately as new data is added. But deleting files from an empty drive with lots of free space allows more time before getting overwritten.
Can you manually overwrite deleted files?
You cannot directly target and overwrite specific deleted files. However, you can overwrite all deleted data on a storage device by filling it with new non-sensitive files, such as movies or music. This overwrites blocks that may contain deleted file data.
Some data deletion software can automate this process by generating random dummy files to fill up all unused space. This makes it much more difficult to recover deleted files, as most of the blocks they occupied are now overwritten.
What about the Recycle Bin and Trash folder?
When you move a file to the Recycle Bin in Windows or Trash folder in MacOS, it can still be easily undeleted intact. This is because the data is not actually deleted – the file is simply moved to a hidden folder. The original file remains untouched until you empty the Recycle Bin/Trash folder.
Only once you empty the Recycle Bin or Trash are files scheduled to be overwritten. Even then, the files remain recoverable until the space is reused. However, operating systems often immediately reuse Recycle Bin and Trash space, assuming users want files gone once deleted from there.
Can strong deletion permanently erase files?
Most operating systems do not offer any built-in way to perform a “strong delete” that overwrites file data immediately. However, there are third party tools that can overwrite deleted files to make recovery impossible.
Deletion software like Eraser for Windows, Permanent Eraser for Mac, and Shred for Linux can overwrite files multiple times with random data before deleting them. This prevents even forensic recovery attempts from accessing the original data.
Strong deletion is the only way to ensure a file is completely erased and unable to be recovered by any means. Standard delete operations are not secure deletion methods.
Is deleted data removed from SSDs?
Solid State Drives (SSDs) handle deletion differently than traditional hard disk drives (HDDs) due to their use of flash memory to store data. HDDs can maintain magnetic traces of overwritten data, while SSDs cannot.
Therefore, when you delete a file on an SSD, the drive controller will immediately erase the file data before making blocks available for reuse. This makes recovery of deleted files from SSDs much more difficult than from HDDs.
However, data remnants can remain if the blocks are not reused. SSDs also often have overprovisioning space that is not visible to users. So deleted data in overprovisioned space may persist until the SSD is rewritten in its entirety.
Can you recover data after formatting a drive?
Formatting a storage device does not inherently delete or erase data – it simply clears the file system information used to access the files. The actual file contents remain on the drive after formatting.
For HDDs and SSDs, data recovery software can scan the raw sectors and extract files that were present before the format. However, this becomes increasingly difficult if files are partially overwritten by new data written after formatting.
Formatting also makes it impossible to recover files without resorting to advanced techniques, as filenames and folder structures are lost. But the file contents themselves can often still be pulled from a formatted drive.
Data recovery from damaged drives
If a storage device has been physically damaged – for instance, if a hard drive suffers from failed read/write heads, scratched platters or PCB damage – this severely complicates data recovery efforts. Advanced specialist labs may be able to transplant components from a matching donor drive to access the data.
However, this kind of physical repair is extremely costly. There is also no guarantee of success, and attempting DIY drive repairs almost always results in unrecoverable data loss and permanent drive failure.
Recovering old or deleted email
For email stored on a local computer in an email client, deleted messages can be recovered from email database files using recovery software if the space has not been overwritten. This allows digging up old email history long after it was deleted.
Webmail like Gmail and Outlook.com retain deleted emails on their servers for a period of time before permanent removal. Gmail offers a 30 day window to recover deleted messages. Outlook.com provides 90 days. Other services may store email for less time.
If the retention period has expired, webmail providers have no way to recover deleted email from backups. Once removed from their servers, webmail is practically unrecoverable without access to a local email client backup.
Can you recover lost mobile phone data?
For lost or deleted files on mobile devices, data recovery software for phones and tablets may help extract messages, contacts, photos and other types of lost phone data.
This type of mobile data recovery works best on iOS and Android smartphones and tablets with microSD card storage. But for iPhones without removable storage, special techniques may be required if no backup exists.
Factors like device encryption and whether USB debugging access is enabled also impact the chances of success. Logically broken phones where the data is intact but inaccessible can often data recovered, but physically damaged phones with component-level faults often result in unrecoverable data loss.
Recovering deleted files vs lost files
There is an important difference between “deleted” and “lost” files. Deleted simply means a file was erased according to the logical file system, usually by a user intentionally deleting it or emptying the trash/recycle bin.
Lost files are those that may be in a still-allocated state, but for some reason cannot currently be accessed. This includes files that were stored on a drive that now fails to function or suffers a corrupted file system. Lost files have a better chance of data recovery than intentionally deleted files.
Can forensic experts recover any deleted data?
Forensic data recovery specialists utilize techniques like magnetic force microscopy and scanning electron microscopy to potentially read very faint magnetic traces left on even overwritten HDD sectors. This makes it possible to recover at least partial data even from overwritten sectors.
However, there is no guarantee that forensic recovery will succeed – it depends heavily on how many times data was overwritten. The more overwrites, the less likely forensic techniques will recover anything usable. Forensic recovery is also disproportionately expensive compared to typical user file recovery.
Backup importance for data retention
Backups provide the only way to reliably protect against data loss. Deleted files can only be recovered if they were not yet overwritten. But once permanently overwritten, no software or hardware method can recover them.
Maintaining good backups of important data offers insurance against data loss events like accidental deletion, file system corruption, storage device failure, ransomware and natural disasters. Without backups, prevention of data loss is next to impossible.
Backup best practices
Follow these backup best practices to gain reliable protection against data loss:
- Use the 3-2-1 backup strategy – maintain 3 copies, on 2 different media, with 1 copy offsite
- Perform backups daily for important file changes
- Retain multiple versions of backups over time – don’t just overwrite the same backup repeatedly
- Store backups disconnected from network access to prevent malware damage
- Use backups to recover accidentally deleted or corrupted files
- Test backups regularly by performing test restores to ensure they work when needed
Conclusion
While deleted files may seem to be gone forever, in reality they often continue existing intact on storage media until their space is reused. This allows deleted data to frequently be recovered using the right software and techniques. However, once deleted files are overwritten even just once, they are generally impossible to get back.
The key takeaways are:
- Deleting files simply marks them as available for overwrite – the contents remain until overwritten
- Free disk space, storage device idle time, and overwrite operations impact recoverability
- Secure deletion requires overwriting files multiple times before deletion
- Backups are mandatory for reliable prevention of data loss from deletion and drive failure
While undeleting files is possible in many cases, the most prudent approach is to regularly back up your data and avoid needing to rely on recovery of deleted files. With proper backups, accidental or malicious deletion does not have to mean losing data forever.
