When a file is deleted on a computer, it isn’t actually erased right away. Instead, the operating system marks the space used by the file as available for new data. So deleted files continue to exist on the hard drive or SSD for some time until that space is overwritten. But where exactly are these deleted files stored? There are a few different places they can reside before being permanently erased.
Recycle Bin
On Windows computers, the first stop for deleted files is the Recycle Bin. When you delete a file, it gets moved here instead of being immediately removed. The Recycle Bin acts like a temporary holding area, keeping your deleted files handy in case you change your mind and need to restore them.
To see your Recycle Bin files on Windows:
- Open the Recycle Bin by double clicking the icon on your desktop or finding it in the start menu.
- You’ll see a list of recently deleted files that have been placed in the Recycle Bin.
- You can restore files by simply dragging them out of the Recycle Bin back to their original location.
The Recycle Bin doesn’t keep deleted files forever though. It will automatically purge files over time as new files continue to fill up the space. How long a file stays in the Recycle Bin depends on your computer’s settings.
Trashed Files on Mac
The Mac equivalent of the Recycle Bin is the Trash. When you delete files on a Mac, they get moved to the Trash folder. As with the Recycle Bin in Windows, deleted files aren’t immediately removed from the hard drive when placed in the Trash.
To view trashed files on a Mac:
- Open the Trash by clicking the icon in your computer’s Dock or choosing Empty Trash from the Finder menu.
- You’ll see a list of recently deleted files that have been moved to the Trash.
- You can restore files by dragging them out of the Trash back to their original location.
The Trash will also automatically delete files over time as space is needed by your Mac. You can control how long files stay in the Trash through your Mac’s settings.
Deleted Files on Linux
On Linux distributions, there is no single Recycle Bin or Trash location that deleted files are sent to. Instead, it depends on the file manager you’re using. For example:
- On GNOME, deleted files go to ~/.local/share/Trash
- On KDE, they go to ~/.local/share/Trash/files
- On Xfce, they go to ~/.local/share/Trash/expunged or ~/.local/share/Trash/info
So the exact deleted files location will vary across different Linux environments. But there is usually some kind of Trash folder that temporarily contains erased files.
Original File Location
Even when a file gets moved to the Recycle Bin, Trash, or a Linux deleted files folder, the actual file contents remain in the original location on the hard drive. The operating system just removes it from the file system index and marks it as free space. But the data itself continues occupying that physical space on the drive until it gets overwritten.
So previously deleted files exist in a hidden state in their original folder, even if you can’t normally see them anymore through the operating system. Data recovery tools can scan drive sectors and reconstruct these deleted files since the contents still reside on the drive.
Free Space
Once deleted files are purged from the Recycle Bin or Trash, they no longer have an easy way to be restored. But that doesn’t mean the contents are erased right away. The operating system simply marks the clusters that were used by the deleted data as being available for reuse. The original contents still remain in those clusters until new data overwrites them.
So previously deleted files exist in the free space on a drive for some time. Exactly how long depends on how full the drive is. On a nearly empty drive, it could be weeks or months before old clusters get recycled. But on a fuller drive, deleted data could get overwritten in just hours or days.
This is why it’s often possible to recover recently deleted files, even if they’re no longer in the Recycle Bin. Data recovery tools scan the free space on a drive and reconstruct files by piecing together contiguous clusters that once contained deleted data.
Swap Space
Another place you might find remnants of deleted files is in a computer’s swap space or pagefile. This is a section of the hard drive or SSD that’s used as temporary overflow storage for memory. Anything not actively being used in your computer’s RAM may get moved to swap space on the drive.
When a program or file gets closed, the contents often get saved from RAM into swap space. Those contents remain there until getting overwritten by something else. So swap space can potentially hold data from files long after you’ve deleted them and emptied the Recycle Bin.
Data recovery tools are able to scan for signatures of deleted files in swap space and recover data from there. Though it’s complex, since multiple pieces of different files are intermixed.
Solid State Drives (SSDs)
Recovering deleted files from traditional hard disk drives involves simply scanning for intact data in the previously used clusters. But things work differently for SSDs.
When you delete a file on an SSD, its contents aren’t immediately erased. But the operating system tells the SSD it can overwrite those blocks whenever needed. SSD controllers use a process called garbage collection to efficiently reuse space. This actively erases deleted data blocks so they can be rewritten.
Garbage collection makes it less likely for deleted file data to persist in the free space on an SSD. Recovering deleted files from SSDs is possible for a short window of time but becomes challenging after garbage collection kicks in.
Specialized Storage Approaches
Some storage devices and file systems take extra measures to thwart access to deleted data:
Hardware Encrypted Drives
Drives that encrypt all their data make deleted files unrecoverable. When encryption keys are removed, deleted data instantly becomes inaccessible gibberish. The contents are still physically stored on the drive until being overwritten, but encryption renders them irrecoverable.
File Shredding
Some programs can “shred” files, overwriting their data multiple times to prevent recovery. This renders even recently deleted files irrecoverable by replacing their contents with meaningless data.
Write Once Storage
Devices like CDs and DVDs can only write data once. Erasing files just marks the space as available. But attempting to recover those files would find dummy data rather than the original contents.
Snapshots and Versioning
File systems with snapshot capabilities, like Apple’s APFS and Microsoft’s ReFS, store previous versions of changed files. But they act like deletions are permanent, not keeping snapshots of deleted files.
Can Deleted Files be Recovered after Formatting?
What if you reformat a drive or reinstall an operating system? This resets the file system, so the operating system no longer sees any previous files. But a reformat alone does not erase or overwrite any of the existing data on a drive. So files deleted prior to formatting often remain fully intact and recoverable by scanning the drive’s sectors directly.
Here are some scenarios where files can still be recovered after reformatting or repartitioning a drive:
- Hard drive is reformatted to a new file system (like NTFS to HFS+).
- Drive is repartitioned to resize or change partitions.
- Operating system is reinstalled or upgraded with a reformat.
As long as the physical storage media is not disturbed, the data remains stored in the same physical locations. So previously deleted files are still lurking there intact until being overwritten by new data written after formatting.
Can Deleted Files be Recovered after Full Drive Erase?
What if you use a program like Disk Utility or Killdisk to perform a full drive erase? This writes dummy data over the entire drive to reset it to a blank state. Are files still recoverable then?
It depends on the type of drive erase performed:
Quick Erase
A quick or fast erase resets the file system and partitioning, but does not actually overwrite existing data. So files deleted before doing a quick erase can still be recovered.
Full Erase
A full drive erase takes much longer because it writes new data to every sector on the drive. This renders previously deleted files unrecoverable, since their original contents are replaced with the new dummy data written by the erase.
So to prevent deleted files from being recoverable, a full erase of the entire drive is needed. Just reformatting partitions or reinstalling an OS is not sufficient, since it only resets file system indexes without altering existing drive data.
Takeaways
Here are some key points to remember about recovering deleted files:
- Deleted files hang around in the Recycle Bin or Trash until being purged.
- After removal from the Recycle Bin, file contents still persist in their original locations.
- File data exists in free space until overwritten by new data.
- Swap space and caches may contain remnants of deleted files.
- SSDs actively erase deleted data blocks, making recovery harder over time.
- Reformatting resets file system indexes but does not erase existing data.
- Only a full drive erase overwrites all sectors, making previous files unrecoverable.
Being able to undelete files requires specialized data recovery tools that can scan and reconstruct deleted data before it gets overwritten. But you only have a limited window of time to recover files before they are lost, especially on SSDs. So act quickly if you need to rescue important deleted documents!
Conclusion
When a file gets deleted, the contents still linger on the storage device in various ways until being overwritten by new data. The operating system may mark the file as erased, but the actual data remains in place until replacement data is written. This allows undelete and data recovery tools to access and reconstruct deleted files, if they can scan the drive before the original data gets overwritten. So the next time you think a file is erased, remember—that data is likely still hiding somewhere on your drive, taking up space.
