It’s a frustrating experience when you delete files from your SD card, only to have them reappear later. This mysterious phenomenon can happen due to several technical reasons related to how SD cards store data. When you delete a file, it doesn’t get fully erased from the memory right away. Parts of the deleted data may remain present in hidden areas, allowing it to be recovered. Issues like wear leveling, caching, and fragmentation can also result in deleted files persisting in an SD card’s memory. Additionally, if the SD card has a virus, that can cause deleted files to reappear. In this article, we’ll explore the reasons behind this issue and provide tips to prevent deleted files from coming back.
How SD Cards Store Data
SD cards use flash memory to store data. This type of memory is made up of electrical circuits called memory cells that can hold either a 1 or 0 value to encode data. The memory cells are organized in clusters called blocks, which contain a set number of memory cells, typically 512 bytes. Multiple blocks together form larger clusters called allocation units or clusters, which are typically 4KB to 32KB in size. When new data is saved to the SD card, it is written into empty blocks in clumps of one or more clusters. The card’s file system keeps track of where data is stored and which clusters make up each file.
The SD card controller writes and erases data in blocks rather than bytes. So when a file is deleted or changed, the new data may not be written in the same physical block location on the card. Over time, as blocks get erased and rewritten, the contents of a single file can end up fragmented across multiple blocks all over the SD card.
File Deletion Process
When you delete a file on an SD card, the file is not actually erased right away. Instead, the file system simply marks the space occupied by that file as available for new data. The contents of the ‘deleted’ file remain intact on the flash memory until that storage space is overwritten with new data.
Here’s what happens when you delete a file on an SD card:
- The file system updates its index and removes the entry for that file. This makes the file ‘invisible’ to the operating system.
- The clusters or blocks that contained the deleted file’s data are marked as free space. The actual contents in those physical blocks remain unchanged.
- When new data needs to be written, the file system will overwrite the old data in the ‘free space.’
So in essence, the file deletion only removed the pointer to the file, not the actual data. The data stays on the card until replaced by new data. This allows deleted files to be recovered using data recovery software, until they get fully overwritten.
For more details see: https://recoverit.wondershare.com/format-sd-card/delete-files-on-sd-card-windows.html
Data Recovery
When you delete a file, it is not actually erased from your SD card immediately. Instead, the operating system simply marks the space occupied by the file as available for new data. The original file remains intact until that space is overwritten by new files. Data recovery software scans the card looking for these deleted but still intact files (Recuva (Freeware)).
Recovery software often searches for file signatures – specific patterns of bytes that are present at the beginning and end of certain types of files like JPG images or Word documents (How To Recover Deleted Files (2024 Guide)). When these signatures are found where a deleted file should be, the software knows the original file is still present and can restore it. Some advanced programs can even reconstruct damaged or partially overwritten files.
By leveraging these techniques, data recovery tools are often able to restore “deleted” files – explaining why they keep coming back on SD cards. However, data recovery becomes less likely the more a card is reused, as eventually the deleted file’s space gets fully overwritten.
File Overwriting
When a file is deleted on an SD card, the reference to that file in the file table is removed, but the actual data remains on the storage device. Overwriting involves writing new data over the existing data where deleted files reside (1). This effectively replaces the old data with new data, making the original deleted data inaccessible.
Overwriting works by targeting the storage blocks where deleted file data is still physically stored. As new files are saved to the SD card, the operating system will allocate these new files to vacant blocks, overwriting any leftover deleted file data present on those blocks. This frees up storage space for reuse rather than that space going to waste harbouring inaccessible deleted file remnants.
Specialized overwrite programs like Eraser and Darik’s Boot and Nuke can also target previously allocated blocks and replace deleted file data with meaningless filler data to render it unrecoverable (2). However, this is unnecessary for basic reuse of space on SD cards which simply save new files normally. The key takeaway is that overwriting ensures secure erasure while allowing an SD card’s full storage capacity to be utilized.
File Fragmentation
File fragmentation occurs when parts of a file are scattered across different locations on the storage device rather than being stored contiguously. This happens over time as files are modified, deleted, and new files are saved. With an SD card, fragmentation also occurs due to wear leveling, which helps extend the card’s lifespan by avoiding excessive writes to any one location.
When a fragmented file is deleted, only the file’s entry in the file table is removed but the actual data remains scattered across the SD card. The operating system marks the space occupied by the fragments as available for new data. Until those fragments are overwritten, the deleted file’s contents still reside on the card.
This is why forensic data recovery tools like Wondershare Recoverit can scan the raw data on the device to recover deleted fragmented files, by stitching the scattered fragments back together like a jigsaw puzzle. So fragmentation enables deleted data to persist until the fragments are overwritten by new files.
Wear Leveling
Wear leveling is a process used in flash memory like SD cards to extend the lifespan of the memory by spreading out the programming and erasing cycles more evenly across all the memory cells. This prevents any one cell from wearing out prematurely. Wear leveling works by keeping track of how many times each cell has been written or erased, and moving data around to balance the usage of the cells.[1] For example, if one cell has been written to 10 times but another cell has only been written to 5 times, the next time data needs to be written it may go to the less used cell to even out the wear. This copying and moving of data allows all cells to be utilized more evenly.
A side effect of wear leveling is that when a file is deleted, the memory controller will simply mark the file as deleted but won’t necessarily erase that data right away if those cells have lower wear. The actual data may get copied around and remain recoverable until it gets overwritten by new data. This helps explain why deleted files can reappear – the deleted data is still intact somewhere on the SD card.
Caching
Caching is a process used by operating systems and apps to store frequently accessed data in temporary storage for quicker retrieval. When a file is accessed from the SD card, it may get cached or copied into the device’s internal storage. Even after the original file is deleted, the cached copy remains. This allows the pointer to the file to be easily repopulated if the app needs to access it again. [1] [2]
Caching provides significant performance benefits by reducing load times. However, it can also inadvertently retain deleted files. The cached copy acts as a placeholder, allowing the operating system to quickly restore the original if needed. This efficient design optimization is why deleted files can mysteriously reappear – they were never fully erased thanks to caching.
Conclusion
In summary, there are several main reasons why deleted files may reappear on an SD card:
File fragmentation – When a file is deleted, it leaves behind fragments on the SD card that can later be pieced back together through data recovery software.
Improper delete process – If a delete command is interrupted or does not fully complete, files marked for deletion may not actually get removed.
Wear leveling – To extend lifespan, SD cards shuffle data around, so deleted files can get copied back into visible memory space.
Caching – Changes made to an SD card while it’s plugged in may not get written to the card right away and exist temporarily in the device’s cache.
Lack of overwriting – Simply deleting files does not overwrite the data, so it remains recoverable until new data occupies the same space.
Understanding these key factors helps explain why deleted files mysteriously reappear on SD cards under certain circumstances.
Tips to Prevent Reappearance
To prevent deleted files from reappearing on your SD card, follow these tips:
Format the SD card – Formatting the SD card will wipe all data and overwrite storage sectors, making it much harder for deleted files to be recovered. Use the “Full Format” option when formatting for maximum effectiveness [1].
Manually delete files – When deleting files or folders, use the option to permanently delete rather than just sending items to the recycle bin. This will help prevent recovery [2].
Overwrite deleted data – Use a file shredder app to overwrite deleted files multiple times. This overwrites the original data making recovery much less likely.
Eject properly – Always properly eject the SD card before removing it from your device. Sudden removal while writing data can lead to file fragmentation.
Turn off caching – Disable caching for the SD card to prevent copies of deleted files being stored by your device.
Using these tips will help prevent deleted files reappearing by thoroughly wiping files making them unrecoverable.
