When a file is deleted from an external hard drive, the actual file data is not immediately erased from the drive. Instead, the reference to the file’s location on the drive is removed from the file system index, essentially “unlinking” the file and marking the space it occupies as available for future write operations. The actual file data remains on the drive until it is overwritten by new data.
So in summary:
- Deleting a file only removes the file’s entry from the file system index.
- The actual file data remains on the drive until overwritten.
- The space occupied by the deleted file is marked as available for future write operations.
Why are deleted files not immediately erased?
There are a few reasons why deleted files are not immediately erased from external hard drives:
- It takes time to physically overwrite data – Performing a full overwrite of all deleted file sectors on the drive would be a lengthy process that would degrade performance.
- File recovery is possible – Removing file entries from the index but leaving the data intact until overwritten allows for undelete utilities to recover deleted files.
- Partially overwritten data may still be recoverable – Even if some data has been partially overwritten, modern forensic tools may be able to recover remnants of old data.
So in general, retaining deleted file data until it is overwritten is done to improve performance and ensure the possibility of file recovery.
Improving performance
Taking the time to perform a full overwrite of deleted file data sectors on an external hard drive would be a lengthy, resource-intensive process. It could degrade the performance of the drive and any operations needing to access or write data to it. To avoid this performance hit, the file system simply flags the sectors as available for future data storage rather than erasing them immediately.
Allowing file recovery
If the file system immediately erased deleted file data, it would be impossible for any consumer-level undelete or file recovery utilities to get the data back. By leaving deleted file data intact until the sectors are reused, there is a window of opportunity for data recovery software to restore accidentally deleted files.
When is deleted file data overwritten?
Deleted file data persists on an external hard drive until the sectors it occupies are written to again, which occurs under two main scenarios:
- New data is written to the same sectors – As new files are created and data is saved to the external drive, some of the new data may be stored in sectors previously occupied by deleted files. The new data overwrites the old data.
- Drive optimization defragments the sectors – The drive will eventually optimize itself by defragmenting – rearranging files and data on the disk so that related data is stored sequentially. This defragmentation process overwrites deleted file data.
So in practice, deleted file data persists until either new data or optimization processes arrange active data so it occupies the same physical sectors as the deleted data, overwriting it.
Writing new data
When new files are written to the external hard drive, the sectors holding deleted file data may be overwritten if they are the next available free sectors on the drive. This depends on factors like:
- How much new data is being written
- Whether the new data is sequential or fragmented
- Whether other free sectors are available
If large amounts of new data are written sequentially, it is very possible this new data will occupy the same sectors as deleted file data, overwriting it.
Drive defragmentation
To optimize performance, external hard drives will eventually defragment themselves by rearranging data and files on the disk so that related data is stored sequentially. As part of this:
- Active files and data fragments are consolidated sequentially
- Unused and deactivated sectors are cleared and reallocated
This defragmentation process will overwrite any deleted file data still occupying unused sectors on the disk.
Can overwritten data be recovered?
If deleted file data has been partially or fully overwritten by new data, it becomes much more difficult to recover. However, advanced forensic data recovery techniques may still be able to recover some data by analyzing the magnetic patterns on the drive platters.
Some considerations on overwritten data recovery:
- Completely overwritten data is generally not recoverable. The new data fully replaces the old magnetic patterns.
- Partially overwritten data may have recoverable remnants where sectors have not been completely overwritten.
- Advanced forensic analysis can sometimes recover data even from partially overwritten sectors by examining platter magnetic patterns.
- The more times data is overwritten on a sector, the less likely forensic methods can recover anything.
So while it becomes very difficult to recover deleted files that have been overwritten, it is not always impossible, depending on the techniques used and the extent of the overwriting.
Completely overwritten
If new data has completely overwritten the contents of a sector, there is virtually no possibility of recovering the old deleted file data. The new data will have fully replaced the old magnetic patterns on the drive platter.
Partially overwritten
If some clusters within a sector were not overwritten, forensic tools may be able to recover partial file fragments by analyzing patterns and remnants left on the disk platters. Success depends on the specific sectors overwritten and how advanced the forensic techniques are.
Forensic analysis
Advanced techniques like magnetic force microscopy can image magnetic patterns on drive platters and sometimes infer what overwritten data contained. This requires specialized equipment, expertise, and perfect conditions to have any chance of partial recovery.
Multiple overwrites
The more times new data overwrites a sector, the less likely forensic methods can recover anything usable. Just a few overwrites of random data make recovery essentially impossible.
Wiping free space to erase deleted files
If you want to ensure deleted files are completely erased from your external hard drive, you can wipe or fill the free space with zeroes or random data. This overwrites any deleted file data in unused drive sectors.
Some options to consider for wiping free space:
- Use built-in wipe free space utilities in your OS like Disk Cleanup in Windows
- Use third-party secure erase tools that overwrite free space
- Fill the drive with non-sensitive files like photos or videos to overwrite free space
- Perform a full format of the drive to overwrite all sectors with zeroes (will erase everything)
Bear in mind that overwriting free space will reduce the chances of recovering any accidentally deleted files you might want back. Weigh this risk against your need for secure deletion.
Operating system utilities
Some operating systems like Windows include built-in utilities to overwrite free space on a drive. For example, the Disk Cleanup tool in Windows has a “Securely erase free space” option that overwrites all free sectors.
Third-party tools
Secure erase tools like Eraser (for Windows) or Secure Eraser (for Mac) can target free space on a drive and overwrite it with zeroes or random data to wipe any deleted file remnants.
Filling the drive
You can manually fill the external hard drive by storing non-sensitive files like photos, videos or music. As these files fill the drive, they will occupy sectors holding deleted file data, overwriting it.
Full format
Performing a full format of the external hard drive will wipe all sectors by overwriting them with zeroes. However, this will also erase all other data on the drive, so only use this method if you need everything erased.
Retrieving recently deleted files
If you just deleted files recently and want to try to get them back before they are overwritten, your chances are decent if you act quickly and don’t write new data to the drive.
Some tips for recently deleted file recovery:
- Use undelete or file recovery software as soon as possible after deletion.
- Avoid writing new data that could overwrite the deleted files.
- Scan the drive with recovery software to see if the files can be restored.
- If the software finds the files, recover them to another drive.
Moving quickly is key, as the longer you wait, the more likely the deleted data could get overwritten by new data or drive optimizations.
Data recovery software
Specialized data recovery tools like Recuva (Windows), TestDisk (Windows/Mac/Linux) and PhotoRec (Windows/Mac/Linux) can scan a drive and restore recently deleted files that have not been overwritten.
Avoid overwriting
Be careful not to save or move files to the external drive housing the deleted data, as this could overwrite sectors containing the deleted file contents and make recovery impossible.
Scan and restore
Use the undelete software to scan the external drive and identify deleted files that are still intact. You should then be able to restore them to another safe location like your main internal hard drive.
Preventing forensic data recovery
If you want to ensure deleted files are completely irretrievable by forensic methods, you need to overwrite the sectors at least once with new random data.
Options to consider for preventing forensic recovery:
- Use disk wiping tools that perform multiple overwrite passes.
- Encrypt the drive before deleting sensitive files, then format and wipe it.
- Perform a full format then immediately fill the drive with non-sensitive files.
- Physically destroy drive platters if disposal is an option.
No single overwrite pass is always sufficient, but overwriting 2-3 times with random data provides decent protection against forensic recovery attempts.
Multi-pass disk wiping
Secure erase tools like DBAN (Darik’s Boot and Nuke) perform multiple overwrite passes with different data patterns to thwart forensic analysis. For example:
| Pass 1 | Overwrites with zeroes |
| Pass 2 | Overwrites with random data |
| Pass 3 | Overwrites with byte patterns |
The more random overwrite passes, the more difficult forensic recovery becomes.
Encrypt then format and wipe
Encrypting the external drive before deleting sensitive files protects the raw data if sectors are not overwritten completely. Formatting and wiping the encrypted drive then makes recovery exponentially harder.
Full format and fill
Performing a full format to wipe the drive, then immediately filling it with non-sensitive files, provides decent protection by overwriting all sectors at least once.
Physical destruction
As a last resort, physically destroying the hard drive platters destroys the magnetic data patterns, preventing virtually any forensic recovery.
Conclusion
In summary:
- Deleted files remain on an external hard drive until the sectors they occupy are overwritten.
- This allows undelete utilities to recover recently deleted files, if they act quickly before an overwrite.
- Forensic tools may still recover fragments of overwritten data if sectors are not wiped multiple times.
- To prevent recovery, overwriting sectors 2+ times with random data provides decent protection.
Understanding how deleted file data persists and is overwritten over time is helpful for both recovering accidentally deleted files and securely wiping sensitive files you want irretrievable.