Infrastructure
Where Do Deleted Files Go?
Deleting a file does not erase its data from your hard drive. Learn what actually happens when you delete a file, how recovery software works, and how to ensure sensitive data is truly gone.
It may seem like a file is gone for good when you delete it from your computer. However, the truth is more complicated than that. A deleted file does not really disappear from your hard drive; it stays there until new data fills up the space it occupied.
What Happens When You Delete a File?
When you send a file to the Trash or Recycle Bin, it is not erased from your hard drive right away. It is instead taken to a temporary storage place and stays there until you decide to empty the bin. The file's data stays on the hard drive even after the bin is empty; it is marked as free space that can be used by other files.
When you delete a file, you remove its record from the file system. The file system is like a directory that keeps track of all the files on your computer. The operating system will no longer know where the file is, but the data itself will still be there. This is why it is often possible to recover deleted files with special software, as long as the space has not been filled with something else.
Deleting a file is a lot like taking the label off a VHS tape. People who are looking for the movie can still find it on the tape, but without the label, it appears as though the movie does not exist. The data stays on the hard drive until it is overwritten.
To manage data successfully and safely, you need to understand this process. Deleting private information might not be enough if you want to be sure it is gone for good. You may need to use additional tools to safely erase the information on your hard drive.
How Can I Get Back Deleted Files?
To recover deleted files, you need software that can scan your hard drive for data that has been marked as available but has not been written over yet. This method might work if the file was recently deleted and the space it occupied has not been filled with new data.
Recovery software works by scanning the hard drive for areas that have data in them but are not currently linked to any file in the file system. After that, it tries to rebuild the file by putting these parts back together. How well this process works depends on how quickly the recovery is attempted and whether the sections have been overwritten.
File recovery works sometimes, but not always. It is much harder or even impossible to recover a deleted file if the space it occupied has been overwritten. The quality of the recovered file can also vary, with some files being fully recovered and others only partially.
Because file recovery is not always possible, it is important to keep regular copies of important data. Regular backups ensure that you can still access a file even if you delete it accidentally and cannot recover it.
What Happens on Various Devices?
Deleted files are handled differently by different systems. On many Android phones, the photo gallery or Google Photos app moves deleted items to a trash folder for a limited time instead of erasing them right away; the name and timing depend on the app and phone maker. Photos and videos deleted from an iPhone are kept in the Recently Deleted album in the Photos app for 30 days before being permanently deleted.
Secure Deletion: Secure deletion does more than just delete a file from the file system; it also makes the data that file occupied unreadable. On a traditional hard drive, that usually means overwriting the space. This is especially important if you want to ensure that all of your private data is truly gone.
SSDs vs. HDDs: How deleted files are handled depends on the type of storage device used. Solid-State Drives (SSDs) handle deleted data with a method called TRIM, which can make recovery harder than with traditional Hard Disk Drives (HDDs). But SSDs also spread data across extra storage areas that software cannot directly reach, so overwriting a single file on an SSD is not a reliable way to destroy it.
How to Make Sure Files Are Really Deleted
Putting things in the Trash or Recycle Bin is not enough to ensure data is safely erased. The most dependable approach starts before you delete anything: turn on full-disk encryption, such as BitLocker on Windows or FileVault on a Mac, so the data on the drive is unreadable without its key. When a whole drive or computer is being retired, follow NIST's media sanitization guidelines, SP 800-88 Rev. 2. Multi-pass overwriting is no longer needed. For sensitive data, NIST calls for a purge method, such as the drive's built-in sanitize command or cryptographic erase, which destroys the encryption keys so the data cannot be recovered. Good data management practices such as regular backups can further help keep your data safe.
For businesses, this is not just good practice. The FTC Safeguards Rule requires covered financial businesses to dispose of customer information securely, and HIPAA requires healthcare organizations to have policies for the final disposal of electronic patient data and the hardware that stores it. Our guide to secure IT asset disposition covers how to retire business devices safely.
If you need help safely retiring business devices or have questions about how to handle sensitive data, please contact Cyber One Solutions.