are archive files still encrypted after deletion?

Question

I'm just curious. It seems that they should be but I googled the question and didn't get a straight answer. If you delete a file it only gets marked as free space on the hard drive and is easily recoverable (undeleted), so I hope it's not the case with archive files, that they remain encrypted after you delete them from the archive. Can you make it clear I'm not wrong on this one?

Answer 1

The answer to your question depends on how the deletion was done.

If the RAR was unpacked and decrypted, a file was deleted from the unpacked directory, and then the directory was rolled back into an encrypted RAR, then the deleted file can be recovered.

If your deletion tool edited the RAR archive directly, modifying the unencrypted structural elements without ever decrypting the encrypted blocks, then the deleted file cannot be recovered since it was never unencrypted on disk.

Answer 2

If the file was encrypted when it was deleted then any recoverable data is still in encrypted form.

This assumes file-level encryption. The answer would be different for a plain file placed into an encrypted filesystem.

Answer 3

I agree with what RedGrittyBrick says in his post.

And if you are really paranoid about the possibility that someone can retrieve your file, you can use utility to permanently remove a file on a mechanical hard drive. For Windows, you can use Eraser. On Linux, you can use the 'shred' command.

Permanently deletion of file on Windows and Linux is only achieve if you are using a mechanical hard drive. Solid state drive and flash memory is based off a different architecture and therefore permanently deletion of a file might not be possible (at least not that I aware of).