File deletion refers to the act of removing a file from storage so that it is no longer accessible through standard means. When a file is deleted, the OS only removes pointers to the file’s data location, but does not immediately erase the contents. Deleted files continue to exist on the storage device until the space is needed for new data and overwritten. However, the files become inaccessible through the file system because the links to their storage locations are removed. This raises the interesting question of where exactly deleted files go and what happens to the data when a file is permanently erased.
Deleting Files
When a file is deleted on a computer or mobile device, the reference to the file’s data is typically removed from the file system, but the actual data itself is often not erased right away (Quizlet, 2022). The file system keeps track of where files are stored through the use of pointers, which act like labels telling the operating system where to find a file’s data on the storage device. Each file has a pointer in the file system’s directory tables.
On desktop computers, mobile phones, and other devices, deleting a file generally removes the pointer to the file but does not erase the actual data immediately. The data still exists on the device’s storage, like the hard drive or flash memory, but the operating system no longer knows where to find it because the pointer is gone. This makes the data inaccessible through normal means, but it still physically resides on the storage media until it is overwritten by new data over time (Microsoft, 2020).
So in summary, deleting a file removes access to the data by erasing the file system pointer, but the data itself often remains intact in storage until replaced with new data. Only when new data overwrites the storage locations does the original deleted file’s data get destroyed (Quintex, 2022).
Temporary vs Permanent Deletion
When a file is deleted on a computer, it can either be temporarily or permanently deleted. With temporary deletion, files are moved to the Recycle Bin on Windows or Trash on Mac OS. This allows users to easily restore deleted files if needed. As explained, temporary deletion offers a user-friendly and flexible approach to file management, allowing for easy recovery of files.
In contrast, permanent deletion removes files completely from the storage device so that they cannot be recovered normally. Permanently deleted files do not go to the Recycle Bin or Trash. Instead, they are immediately removed from the file table, and the space they previously occupied is marked as available for new data. Permanent deletion is often done for security reasons to prevent recovery of sensitive files. It requires more intentional action than standard deletion. Once a file is permanently deleted, it typically cannot be recovered without specialized data recovery software.
Temporary deletion gives users a second chance if they delete something accidentally. However, permanently deleted files are gone for good in most cases. Understanding the difference between these two types of deletion allows users to better manage their files.
File Storage on Devices
Files are stored on various storage devices like hard disk drives (HDDs), solid-state drives (SSDs), USB flash drives, CDs, and DVDs using a logical storage scheme called a file system. The file system handles how data is stored, organized, and retrieved from a storage device.
On hard drives and solid-state drives, files are written in blocks to sectors on the physical disks. The sectors are addressed linearly providing a logical block addressing scheme to locate files. The file system maintains metadata about each file like name, location of blocks, size, permissions, timestamps, etc. in structures called inodes (index nodes). Pointers link inodes to data blocks containing file contents.
According to Mesnier (2003), “the file system provides a layer of abstraction above physical devices, allowing arbitrary file layouts that may span multiple disks.” So the linear sectors are mapped to file contents using inodes and pointers managed by the file system.
On optical media like CDs and DVDs, files are laid out in a sequential spiral track of blocks from the inner to outer edge. The file allocation table (FAT) keeps track of which blocks belong to which file. USB flash drives also use a FAT filesystem to map data blocks to files.
Overall, the file system handles mapping file metadata and content to sectors on a storage device in a logical fashion so the user can easily access files by name independently of the physical location.
Pointers and File Tables
When a file is stored on a storage device, the operating system needs a way to keep track of where exactly that file is located. This is done through the use of pointers and file tables.
A pointer is a data type that stores the memory address of another value. In the context of file storage, a pointer stores the address where a file is located on a storage device. According to GeeksforGeeks, when a file is opened in C programming, the fopen() function returns a file pointer that can be used to identify that file in future operations.
The operating system also utilizes a file table to keep track of open files. The file table contains entries for each open file, including the file name, pointer to the location of the file, and other attributes. As described in Go4Expert, the file pointer contained in the file table entry points to the first byte of the file on disk. This allows the operating system to access the correct location of the open file when needed.
In summary, pointers provide the exact disk location of files, while file tables use those pointers to maintain information on open files. This system allows the operating system and programs to easily access the correct files as needed.
What Happens on Deletion
When a file is deleted, the pointers in the file table that point to the actual data on the hard drive are removed. The links between the file name and the actual data blocks on the hard drive are broken. However, the actual data itself is not deleted or erased from the hard drive. The data blocks where the file was stored are simply marked as “available” and can be overwritten with new data.
For example, let’s say file A was stored in data blocks 1, 2 and 3 on the hard drive. When file A is deleted, the file table is updated to remove the pointers to blocks 1, 2 and 3. Now the file system sees these data blocks as available free space to write new data. However, the original contents of file A in those blocks remains on the drive until new data overwrites it.
So in summary, file deletion removes the mapping of file names to data blocks. It does not immediately erase the underlying data. The data blocks are only erased and overwritten when the space is allocated to a new file. According to this source, this is what happens when files are deleted on Windows systems. The process is similar on other operating systems like Mac and Linux.
Secure Deletion
When a file is deleted using standard methods like pressing delete or emptying the recycle bin, the file isn’t actually erased from the storage device. Instead, the operating system removes the file’s entry from the file table, which is like an index of all the files on the drive. This makes the space occupied by the file available to be overwritten with new data. Until that space is needed, the original deleted file remains intact on the device.
Secure deletion methods like degaussing aim to prevent this by completely erasing files to make recovery impossible. Degaussing exposes the storage device to a powerful magnetic field that destroys the magnetic properties of the disk. This irreversibly scrambles and erases all data, including both free space and used space. Other secure deletion methods include overwriting files multiple times to replace content with random data, or encrypting a device before factory resetting it.
Secure deletion ensures previously deleted files cannot be recovered by data recovery software or forensics methods. Many businesses and government agencies use degaussing, disk encryption, and multi-pass overwriting to permanently destroy sensitive files and prevent unauthorized access (Source). While more time consuming than standard deletion, secure deletion gives total assurance that deleted data is unrecoverable.
File Recovery
Even when files are deleted, they often still exist on the storage device until being overwritten by new data. This provides an opportunity to recover deleted files if proper recovery software is used quickly enough (Nordic-Backup, 2022).
When a file is deleted on a computer, most operating systems like Windows or MacOS don’t immediately remove the data from the hard drive. Instead, they mark the space occupied by the deleted data as “available for overwrite”. The original data remains intact until new data overwrites it. This allows file recovery software to scan the hard drive and restore deleted files by looking for data marked as deleted but not yet overwritten (Acronis, 2022).
However, the longer a deleted file remains on the drive, the higher the chance of it being partially or fully overwritten by new data. That’s why it’s critical to use file recovery software as soon as possible after deletion. The sooner it can scan the drive and restore the deleted data before anything overwrites it, the better the chance of full recovery.
There are techniques like secure deletion that overwrite deleted files multiple times to prevent recovery. But typically deleted files remain recoverable if recovery is quickly attempted and the storage space hasn’t been reused.
Permanent Deletion
When a file is deleted from a storage device, the reference to the file’s data on the disk is removed from the file table, but the actual data still remains on the disk until it is overwritten by new data. This allows deleted files to be recovered, as long as the original data clusters haven’t been overwritten.
However, if a deleted file is overwritten by new data, it becomes permanently deleted and can no longer be recovered. The original data is overwritten by the new data, making it irretrievable. For example, when new files are saved, downloaded, or transferred to the storage device, they may claim the clusters that were previously occupied by deleted files.
Once this occurs, there is no way for data recovery software to reconstruct the original deleted files, as the clusters no longer contain the original data. The more a drive is used after files are deleted, the higher the chance that deleted files will become permanently overwritten. Some ways deleted files may become irrecoverable include:[1]
- Saving new files to the disk drive
- Installing or updating applications
- Defragmenting the hard drive
- Continued general computer use overwriting deleted file clusters
Therefore, the key to recoverability of deleted files is how much and how soon new data overwrites the storage space previously occupied by deleted files. The less time that elapses between deletion and recovery attempts, the more likely recovery will be successful before permanent data overwrite.
[1] https://www.easeus.com/data-recovery-solution/recover-permanently-deleted-folder.html
Conclusion
In summary, when a file is permanently deleted on a computer or storage device, the file’s entry in the file table or file allocation table is removed, severing the connection between the file name and the actual data. The data itself is not initially erased, but simply marked as free space to be overwritten. Without a pointer leading to the data, the file becomes inaccessible through standard methods.
Secure deletion methods such as degaussing, encryption, and multi-pass overwrites are required to fully render deleted files unrecoverable. Otherwise, data remnants often persist until being overwritten by new data. While deleted files may seem to vanish instantly, traces remain behind the scenes for a period of time and can still be recovered using forensics tools.
Understanding the underlying processes on devices helps explain why deleted files can often be restored. While removing a file may give the perception that it’s gone forever, additional steps are needed to prevent forensic recovery.
