Tech – for Everyone

Tech Tips and Tricks & Advice – written in plain English.

Delete does NOT erase your data*– preventing recovery

I don’t know how long it was that I worked and played on computers before I truly understood that when I erased a Word document from my My Documents folder it was not gone forever.
It was only natural to think it was “deleted”. It was gone, as far as I could tell. It didn’t show up no matter how I searched for it nor how desperately I needed it back. And believe me, there was many a time that I wished I could get a deleted letter or homework assignment back. (I am, in particular, thinking back to my Windows 95 days, and my hard drive was 4.3 Gigabytes. I was a fanatic about “disk doubling” and emptying my Recycle Bin!) If I cannot see it…and my machine cannot see it…and my machine says that the space it took up is now ‘free’…it is gone, right? I certainly thought so.

I think it’s rather important that you understand, if you don’t already, that when you right-click+delete, or drag something into the Recycle Bin, it isn’t really erased. Instead, the name/path entry in the file allocation table (the directory used to locate and ‘find’ files) is altered in a way that tells Windows to no longer display the file and that this (physical) area is now available for future storage. The same thing happens when you take the drastic step of formatting your hard drive — it isn’t “wiped” like taking an eraser to a chalkboard: the Master Boot Table and the file directory are similarly altered, and once that occurs the machine can neither find your files nor your operating system — the rest of the 1’s and 0’s are left in place.

It is because of this fact — that files aren’t erased, but their directories and names are altered — that undelete and unformat utilities can perform their miracles. Instead of ignoring or treating these altered entries as writable space, they (attempt to) deliberately seek them out and rename them back to a recognizable formula, which restores Windows’ ability to ‘see’, find, and display them. So, why couldn’t my undelete restore my file? The most likely reason is: because Windows sees the deleted file as usable space, it has written something new in that location — and now that new 1’s and 0’s are there, your file really and truly is gone. (The more time that elapses since you deleted the file, the more likely it is that it has been written over.)

[ A quick aside: I look at a lot of systems’ hard drives, and I’ve found that today people tend to be the opposite of me and my space-paranoia, born out of small HDs. It strikes me that they don’t “recycle” anything. ]

Tip of the day: Never assume that your data has been erased. In fact, I suggest thinking in an opposite manner: assume that no matter what proactive measures you’ve taken, your data is on that hard drive. Tell yourself that a knowledgeable person with the right tools, if they get their hands on your hard drive, can read it. (There are some people in this industry who insist that your files aren’t really gone until your hard drive has been melted in a blast furnace!) Particularly keep this in mind when the time comes to donate (or otherwise get rid of) your old computer.

If you are security-conscious, and you want to ensure that when you erase something it’s really and truly erased (or you are about to donate your old PC) I recommend that, if you don’t already have one, you download a free file shredder utility (I will put one as today’s free link) and to choose one that offers multiple methods of shredding. What a “shredder” does is it writes new data, and it does it in multiple passes. Typically writing all 1’s on one pass, all zeros on the next pass, and then a completely random pattern of 1’s and 0’s, and so on. It is generally recognized that your shredder should make 6-12 passes.
* If you do this, you can donate your old PC comfortable in the knowledge that only a several thousand-dollar restoration, performed in a sterile lab, might render your personal information readable again. (If you are a corporation, and it’s time to throw out your old hard drives, and there’s highly sensitive data on those drives…melt them.)

Today’s free link: Zilla Data Nuker 2 (Please note: this program is an exception to my rule of always having run and tested the links I suggest. I have not ever needed to download a file shredder as I’ve always had one bundled into the Utility Suites I have on my machines. However, this application is 5-star rated by Cnet, and I was unable to locate it on any “blacklists”. It is the one I would try first.) From Cnet, “This powerful program helps you shred important files & folders so that they cannot be restored & prevent attempts to recover sensitive deleted files from your hard drive by data recovery or forensic software. Shredder allows you to purge, wipe & erase data with methods that far exceed US Department of Defence standards for file deletion (DOD 5220.22). Easily automate the cleaning process with batch files, shortcuts and scheduler. Supports complete folder deletions including subfolders.”

*Original post: 6/22/07

Copyright 2007-8 © Tech Paul. All rights reserved.jaanix post to jaanix

Share this post :

May 6, 2008 - Posted by | advice, computers, file system, how to, PC, security, tech, Windows | , , , , , , , , , , , , , , , ,

8 Comments »

  1. […] Go to the author’s original blog: Delete does NOT erase your data*– preventing recovery […]

    Like

    Pingback by Delete does NOT erase your data*– preventing recovery | Free Links Digest | May 6, 2008 | Reply

  2. That’s a great Point, but what really kills me is the space it takes!! Thank your for the information!

    Like

    Comment by frank | May 6, 2008 | Reply

  3. Frank–
    As far as the OS is concerned (Windows, usually), your deleted 0’s and 1’s are open and available space. So the next time it wants to write to the disk, it can (and often does) ‘over write’ in that area.. so there’s really no wastage.
    That’s why if you do accidently delete something, you want to try to undelete it as quickly as possible– once it’s overwritten, by normal everyday use, running the defrag tool, or a “shredding” tool, it really is gone.

    Like

    Comment by techpaul | May 6, 2008 | Reply

  4. Paul,

    Great post! We covered a similar topic- Steps you need to take to make sure all your data is gone before you donate a computer– and also, steps to make sure all the guy-before-you’s data is gone before you start using a used computer you’ve acquired (don’t want to get busted for some stranger’s poor taste or illegal goings-on :)

    Thought it would make a nice addendum to your post:
    support.com blog

    Like

    Comment by Heather | May 9, 2008 | Reply

  5. i would like to know how to get rid of myspaceim with skype. but save my space with out having skype

    Like

    Comment by mim | September 8, 2008 | Reply

  6. mim–
    I’m a bit confused by your question. MySpace is a Website that you visit on the Internet. You couldn’t ‘remove it’ if you tried. (Your “profile” can be deleted though.)
    MySpaceIM (powered by Skype) is a program on your machine. You remove it (called “uninstall”) as you would any other program: Start> Control Panel> Add/Remove Programs.

    If you need some help making MySpaceIM work, visit their FAQ page, here, http://www.myspace.com/index.cfm?fuseaction=im.faq

    Like

    Comment by techpaul | September 8, 2008 | Reply

  7. To those out there reading this, in simple terms, when you delete something and remove it from the bin, it is still there, you’re just telling your computer that it can over write the data when it really needs to/when there is no more free disk space.

    Like

    Comment by jason | October 4, 2008 | Reply

  8. Jason–
    That’s kind of what the titles says.. isn’t it?

    And you aren’t exactly correct: the OS can and will write to the now-available space whenever.. it has nothing to do with “running out of space”. Which is why if you need to perform data recovery, you want/need to do it as soon after the deletion as possible. Also, you don’t want to use a undelete tool that writes, only reads.. and have it installed before you need it… or the act of installing it could put it on top of the files you’re trying to recover.

    Like

    Comment by techpaul | October 4, 2008 | Reply


Post your Comment/Question

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: