Understanding the Fate of Deleted Files: What Happens When You Remove a File Permanently?

Deleting a file is a common task that we perform daily, but have you ever wondered what truly happens to the data? It is a process that involves more than just removing the filename from a directory; let's delve into the intricacies of the file deletion process.

What Happens When You Delete a File?

When you delete a file, it goes through several stages:

1. Direct Removal Via Terminal Command or OS Command

The file consists of two parts: a set of interlinked sectors on the disk containing the data portion of the file and a directory entry that provides the file name and other metadata, including file permissions and a pointer to the beginning of the data sectors. When you use a rm command (Linux) or del (Windows) to delete a file, the system updates the directory entry to invalidate it and move the file's data sectors to the free space category. The data is not immediately removed but is available for reuse.

Other Forms of File Deletion

There are three primary methods of deleting a file:

1. Deleting via Terminal or OS Command

This method involves directly invalidating the directory entry of the file, making it inaccessible until the space is reused. However, the actual data remains intact and can be recovered using specialized software.

2. Moving to the “Waste Bin” or Trash

When you move a file to the recycle bin or trash, the file is moved into a special directory, and new metadata is added to track its original location. This allows the user to recover the file and restore it to its original directory if needed.

3. Permanently Deleting from the Trash

This method is essentially a repeat of the first, but it applies directly to the trash directory. Files in the trash must be permanently deleted using the same process as above.

Key Point: The data is not removed from the disk at any point during the deletion process! The data remains in the sectors, and the directory entry is updated to invalidate the file. Until the space is reused, there is a possibility of data retrieval using the right tools.

Safeguarding Against Data Recovery

To prevent data from being recovered after deletion, specialized software can overwrite the data sectors with a pattern of bits. This process is known as 'shredding' the data:

Bit Pattern: Some software uses a pattern like x’00’, while others use x’FF’, x’20’, x’40’, or x’80’. Multiple Overwrites: The most paranoid and reliable method involves multiple overwrites to eliminate any possibility of data retrieval even using advanced forensic tools that utilize quantum effects.

Overwriting the data multiple times makes the file unrecoverable and provides a layer of security, but it is also a sign of forensically suspicious activity. Question arises: If someone goes to such lengths to secure their data, what exactly are they trying to hide?