This article will explain what happens to data when it is deleted from a hard drive. Understanding the process of deleting data and what actually happens to it is important for several reasons:
First, it helps explain why deleted files can often be recovered. When a file is deleted, the reference to it is removed but the actual data may still reside on the hard drive. This allows for file recovery software to potentially restore deleted data.
Second, knowing that deleted data may remain on a drive emphasizes the need for proper data security precautions. Sensitive information should be securely wiped from a drive before disposing of it to prevent unauthorized access.
Finally, understanding file deletion helps illustrate why reformatting a drive does not completely erase data. There are additional steps beyond reformatting required to fully wipe a hard drive.
This article will provide an overview of how file deletion works on hard drives, whether data is still recoverable after being deleted, and the various methods of permanently destroying data on a drive.
How Deleting Works
When you delete a file on your computer, the data is not instantly erased from the hard drive. Instead, the file is simply marked as deleted in the file allocation table (FAT) that keeps track of used and available space on the drive [1]. The space the file occupied is now considered available to write new data. Until that space is overwritten, the original deleted file content remains intact on the physical drive.
When you hit delete, the operating system removes the file’s entry from the file table so it appears deleted to the user. But the actual data still resides in the same physical location on the drive, only now considered free space instead of allocated to that file. The OS can now write new files in that location if needed. So deleted file data sticks around until the OS saves new data over it [2].
In essence, “deleting” a file does not immediately erase the data – it just marks the space as available for overwriting. The original data continues existing in physical form on the hard drive until the OS overwrites it.
Data Remains on Hard Drive
When a file is deleted from a hard drive, the data itself is not immediately erased. Instead, the space occupied by the deleted file is marked as available and can be overwritten by new data. However, until that space is reused, the original data remains intact on the physical hard drive platters. This is because deleting a file only removes pointers to the data, not the data itself (1).
The original deleted data persists in the unallocated clusters on the hard drive and can be recovered using forensic tools. When no new data overwrites it, all of the deleted file’s content remains fully intact for an indefinite amount of time. Hard drive platters retain magnetic traces of the deleted data until replaced with new data. So while the files are inaccessible through standard interfaces, the raw underlying data remains on the physical storage media (2).
Therefore, deleting files or formatting a hard drive does not actually erase the data instantly. The original data remains recoverable from the physical drive until it gets overwritten by new data.
Secure Deletion
There are secure deletion options that can help permanently erase data from a hard drive by overwriting the space on the drive to prevent recovery. One common method is to use a shred utility that will overwrite the space where deleted files were stored multiple times.
According to IBM, “Secure data deletion effectively erases or overwrites all traces of existing data from a data storage device. The original data on that device becomes unrecoverable.” https://www.ibm.com/docs/STSLR9_8.3.1/com.ibm.fs9100_831.doc/svc_secure_data_deletion.html
Some shred utilities will overwrite the empty space up to 35 times, making the original data essentially irretrievable. The more overwrite passes, the more secure the deletion. This prevents data recovery using forensic tools.
File Recovery
Even when a file is deleted from a hard drive, its data still remains on the drive until that section of the disk is overwritten by new data. This makes it possible to recover deleted files intact using data recovery software as long as the original data hasn’t yet been overwritten.
There are various free and paid data recovery programs that can restore deleted files from a hard drive, such as Recuva, Disk Drill, Recover My Files, FreeUndelete, and EaseUS Data Recovery Wizard. These tools scan the drive and retrieve files that were deleted from the Recycle Bin, or permanently deleted files that weren’t sent to the Recycle Bin. As long as the original data still exists somewhere on the drive, recovery software can find and restore it.
The likelihood of successful file recovery depends on how much new data has been written to the drive since deletion. The sooner data recovery is attempted, the greater the chances of recovering files intact before they get overwritten. Data recovery from external hard drives also has good success rates if they were disconnected right after accidental deletion, minimizing overwriting.
Overall, while deletion may seem permanent, data recovery software provides a powerful means to recover deleted files from hard drives as long as the original data still exists. This makes accidental deletion far less disastrous, as long as quick action is taken before new data overwrites the deleted files.
Encryption
Encryption protects deleted data from being recovered by scrambling the contents of the hard drive so they are unreadable without the proper decryption key (Source: https://superuser.com/questions/1703126/does-encrypting-a-partition-prevent-data-recovery). When a hard drive is encrypted, even if a file is deleted, the encrypted data remains on the drive. However, without the encryption key, the scrambled data is inaccessible and unrecoverable. File recovery software relies on being able to read deleted data still residing on the hard drive, but cannot recover encrypted data even with professional tools (Source: https://www.quora.com/Are-encrypted-hard-drives-much-harder-to-recover-data-from-even-using-professional-data-recovery). Therefore, encryption provides an added layer of protection for deleted files.
Reformatting
Reformatting a hard drive does not actually erase or delete any data, it simply recreates the file system to make it appear empty. When a drive is formatted, such as the standard Windows formats like NTFS or FAT32, it creates a new file system and a fresh directory of where files are stored. The actual contents on the disk itself are not touched. Any existing data still physically remains on the hard drive, even though the operating system will no longer be able to access it or detect it. Formatting essentially wipes clean the “table of contents” for the hard drive, but does not actually remove any of the underlying data. So a reformat does not securely erase the data or make it unrecoverable. Special tools and recovery software can reconstruct the old formatted file system and regain access to any data that remained intact on the drive. Therefore, reformatting does not reliably erase data or prevent it from being recovered by those with the right tools and knowledge.
Physical Destruction
One of the most effective ways to ensure deleted data cannot be recovered from a hard drive is to physically destroy the drive itself. This involves literally destroying the physical components of the hard drive in order to make the stored data unreadable and unrecoverable. Methods for physically destroying hard drives include:
Shredding – Hard drives can be shredded into small bits of metal using an industrial shredder, similar to how paper is shredded. Shredding completely destroys the platters and components that store data. According to Shredall, shredding is the most effective way to permanently destroy a hard drive.
Drilling – Using a drill to put holes in the hard drive platters will make the data unreadable. However, multiple holes may be required to fully destroy the drive.
Smashing – Smashing a hard drive with a hammer or crushing it can render the data unrecoverable. However, smashing may need to break the drive into small pieces to be effective.
Degaussing – Special degaussing wands or devices use strong magnets to scramble and erase data stored on hard drives. However, degaussing may not work on newer drives.
Incineration – Burning hard drives in an incinerator at extremely high temperatures can reduce them to ash and make data irretrievable.
Overall, while physical destruction can be time-consuming, it is one of the most reliable ways to ensure a hard drive contains no recoverable data. Companies that specialize in hard drive destruction usually use industrial shredders or incinerators to completely obliterate drives and the sensitive information they contain.
When Data Is Overwritten
When a file is deleted on a hard drive, the reference to that file’s location on the disk is removed from the file system, but the actual data remains in place until it is overwritten by new data. Overwriting old data makes recovery difficult because the original contents are destroyed in the process.
According to experts, once data has been overwritten on a hard drive, it becomes virtually impossible to recover the original information (Source 1, Source 2). When new data is written over the same physical location on the drive, the magnetic polarities are changed to match the new data. The previous contents are permanently erased.
Some advanced recovery techniques like magnetic force microscopy can read traces left by previous writes. But they cannot reconstruct original overwritten files. The more times data is overwritten on a location, the less likely any recovery becomes. Therefore, secure deletion techniques overwrite storage locations multiple times to ensure original data cannot be recovered.
Conclusion
In summary, when a file is deleted on a hard drive, the data itself is not immediately erased. The file system simply marks the space allocated to that file as available for overwrite. Until those sections are overwritten with new data, the original deleted file remains intact on the disk.
There are several factors that determine how long deleted files persist, including the capacity of the disk and how much new data is written after files are deleted. Generally, the more new data is saved, the less likely deleted files can be recovered. However, with advanced forensic tools, deleted files can often still be recovered unless the disk is completely overwritten or physically destroyed.
The takeaway is that deletion does not equal destruction. Users should practice secure deletion techniques like overwriting files multiple times or using file wiping software if they want to ensure deleted files are unrecoverable. Simply deleting files and emptying the recycle bin does not fully remove data. Caution is advised if giving away or disposing of old drives that may contain sensitive information.