Is That File You Deleted Really Gone?

That File You Thought Your Deleted Might Still Be On Your Drive

DeleteKey_StevenPuetzer_Getty.jpg
Photo: Steven Puetzer / Getty

When you erase a file on your computer, its first stop is usually to your operating system's "recycle bin" or "trash" folder. It's placed in this temporary garbage area in case you change your mind and you want to later retrieve the file.

Most people assume that once they take the extra step of "permanently" deleting the file from the recycle bin, that it is now officially gone from their hard drive, and past the point of recovery.

What many people don't know is that there is a strong possibility that recoverable data may still remain on their hard drive even after they have deleted the file from the recycle / trash area.

If I Deleted a File, Why Can it Still be Recovered?

According to Wikipedia, Data Remanence is "the residual representation of digital data that remains even after attempts have been made to remove or erase the data". 

When you delete a file, the operating system may simply remove the pointer record to the file, making it inaccessible via the operating system's file browsing tools. This doesn't mean that the actual data was ever removed from the disk drive. 

Data Forensics Tools May Help Bring Back Files From The Dead

A lot of computer forensics specialists make their living by resurrecting files that people (including criminals) may have thought were destroyed. They use specialized recovery software that scans the disk media for recognizable data.

These special tools are created to ignore the traditional constraints imposed by an operating system and its file system. The tools look for file headers used by software applications such as Excel, Word, and others to determine what type of data may be recoverable.

What the tools can actually recover depends on several factors, such as whether or not the data of the file is still intact, has been overwritten, was encrypted, etc.

Amazingly enough, sometimes it's even possible to recover data on a drive that had been thought to have been formatted. If a "quick format" was used, then only the File Allocation Table (FAT) may have been deleted, possibly allowing recovery of files that would be assumed to have been deleted during the format process.

Criminals Buy Used Hard Drives

Cybercriminals know that data is often recoverable on hard drives that have been thrown out. They may seek out yard sales, Ebay auctions, Craigslist ads, etc, for used computers in hopes of using forensic tools to recover personal data off of the discarded hard drives. They could use this information for the purpose of identity theft, blackmail, extortion, etc.

How Can You Be Sure Your File Is Gone For Good?

Before you sell, or get rid of an old computer, it's best to remove and keep it's hard drive. You could wipe the hard drive completely with military-grade disk wipe utilities, but you can't be absolutely sure that some new forensic technology won't come out in the not-to-distant future, allowing recovery of data that was previously unrecoverable using current methods. For this reason, it's probably best not to sell your old hard drive with your old computer.

Things That May Help Get Rid of That Deleted File for Good:

Defragmenting

Many file recovery utilities warn users that defragmenting the hard drive may lower the odds of being able to recover files because the defrag process itself consolidates data and may overwrite the areas where the deleted data was present. While it may help, simply defragmenting your drive will not ensure that data is unrecoverable so you shouldn't rely on it as a method of deletion.

Encrypting Data

Forensic tools may be able to decrypt data, but if the encryption is strong enough then the tools may not be able to resurrect the contents of a file.

Consider turning on your operating system's disk encryption feature to take advantage of this capability. Also consider using tools such as TrueCrypt for encrypting your sensitive files.

Try a Little DIY File Recovery On Your Own

If you want to see what files might be recoverable on your own system, why not try to a little Do-it-Yourself data forensics and try to see what you can recover using a free demo version of a file recovery tool? You can find out more about how to recovery deleted files in our article: DIY File Forensics.