What happens when you delete files?

I never even thought of this before until just now...What does the hard drive do exactly when it deletes files? Does it rewrite the platter with "blank" data?

 

They are most assuredly not deleted. Windows does write over anything when it is deleted. You can most times recover it. There is special software called scrubbers which will write over data many times thereby rendering irretrievable. You should do it when you get rid of a drive or PC, but most people do not.

 

It's actually not deleted. I think what happens is that the file's entry in the Master File Table is flagged as "overwriteable". You won't see the file anymore, although it is still on the hard drive. When new data needs to be written to that sector, your file gets overwritten and you then lose it forever.

So theoretically, you could still have files you deleted several years ago on your old computer, and these files could be retrieved using some software tools.

 

In reality, the pointer to the file(s) will be deleted, and it will tell the OS that the space is marked as usable for storage. The OS can use that space freely. But before that, the file will physically still be there (refer to the 2 post above). It's bad for security though, as anyone can retrieve those files.

 

Files are never, or extremely rarely, written as one continuous string to the hdd. I'm, pretty much, saying this for the FAT12-16-32 file system.

So, anything written is broken into parts. Those parts have words at the beginning and end of the first part, and at the beginning and end of each subsequent part.

When you delete something, the first word of the first part has one bit altered. That's all, afaik, that makes the file "disappear" from usage. Recovery systems, I should say recovery software, figures out which and what bit has been altered and restores those bits.

If the hdd has not been written to chances for recovery are excellent to retrieve a completely deleted Windows FAT file. The more it's written to, after a deletion, the less of a chance to recover, since those spaces will be already re-used.

And I ain't no guru!

Software like Gibson's Spinrite is supposed to be able to analyse the magnetic footprint data leaves on the surface of a hdd disk and make an attempt at recovery of data in this manner. I own a copy but really haven't played with it much. Spinrite also only works on FAT file systems to the best of my knowledge. NTFS files- not.

 

I've read it described as your PC "forgetting" that the data is there. But it is still recoverable for those with the right software as stated above

 

in mac... you have an option called "Secure Empty Trash" next to "Empty Trash" secure empty trash overwrote the data with zero (as in binary 1 and 0). but i've read somewhere that this is not enough to securely delete ur data.

 

Wow. Thanks for the pretty thorough explanations guys!

 

You're welcome!

 

(smile) Some other bits on physical data, off the top of my head.

US govt specs for _eliminating_ data on a hdd, is to write zeros to the media 8X. To allow resuse of the media.

British stds for safe _destruction_ of hdd data: take the hard drive apart, remove the platters. Grind the platters completely to grit. Store the grit for, I don't know, something like 10 years. That's their secure destruction specs. They may call for destruction of the other hdd bits like the motor and case, too.

 

can't magnets erase the data from hard drives also?

 

They can corrupt data on a harddrive, yes. (It won't give you straight 0's, as you might expect from "erasing", and of course, you can't control what data is corrupted and what is left alone, and it won't neatly remove entries from the index when a file is "erased". Rather, it'll just corrupt the entire thing.)

It's not recommended as a secure erase method though, because you need *really* powerful magnets to make much of a difference. (Think about it, the entire harddrive works by having powerful magnets within a millimetre of the platter. How much of an effect do you think a magnet outside the HDD casing would typically have?)
It is possible to securely wipe a harddrive with a magnet, but it takes a hell of a lot more than your average refrigerator magnets.

 

As Jalf said - magnets should be very strong or very near.
I read one article of a man complaining that he put his external drive next to the loudspeaker and that he lost some data afterwards. I really doubt that story.

Ivan

 

To clarify some things here and I actually know this for fact so you know. This references FAT12/FAT16/FAT32 so I am not 100% certain on NTFS but it may apply there.

When a file is created there is an entry created in the Master File Table (MFT) that points to the first sector of the file. Then at the end of each segment of the file a pointer is set to point to the next segment and so forth.

When you delete a file the entry in the MFT is changed. Basically the first letter is removed and causes the system to recognize the file as deleted.

What undelete software did was scan the MFT for entries like that and present them to you. The pointers still exist if the entry in the MFT hasn't been overwritten already. All you have to do is undelete it.

Here is the other part... Since the file was marked as deleted then some or all segments of the file may of been overwritten by another file and here is where cross-linked files come into play. Basically 2 files that at some point refer to the same segment on the drive. Can happen when a file has been undeleted after the drive has been used a bit.