48
5
Correct me if I'm wrong here, but when you "delete" something from your PC all your computer does is write over some of the binary with 0's replacing the 1's. (Or something to that effect) So when you send something to the recycle bin it writes over part of the file, and when you delete from the recycle bin it writes more?
Shea A.
Posted 2014-09-27T08:57:04.127
Reputation: 672
86
Neither operation writes over the file.
Moving a file to the Recycle Bin does just that – moves the file, and it is the same as any other "move" operation when the new folder is on the same disk: the filename entry is moved from its original folder to another, but the file's content is still on the disk and is not physically moved, modified or even looked at.
Deleting a file from the Recycle Bin (or deleting it directly using Shift+Delete) removes the filename entry from its folder. The part of the disk previously occupied by the file is still not modified or overwritten and still contains all the file data, but that data is no longer linked to a filename. That spot of the disk is recorded as "free", however, so future writes to the disk can reuse that space, and if you keep using the disk the space will almost certainly be overwritten eventually.
In the case that you need to prevent recovery of deleted data, special tools exist to overwrite the data securely. That is not done by default because it is slow and increases wear on the disk.
Boann
Posted 2014-09-27T08:57:04.127
Reputation: 939
33To expand on the "moving a file" bit, the Recycle Bin is just an ordinary folder on your hard drive that Windows shows to you in a special way. – Mark – 2014-09-27T19:54:09.050
9@Mark not quite, I believe - there's a 'recycle bin' folder on every drive (is it .$TRASHES? can't remember), and Windows combines all of them when you open the Recycle Bin. So your C: drive and E: drive both have a folder, because Windows doesn't want to copy everything when you delete it (that's the whole point!). – Riking – 2014-09-28T05:39:49.177
The name changes from version to version, but it's usually some variation on "recycle". – Mark – 2014-09-28T09:27:55.627
1In fact, this piece of trivia is instrumental to software that recovers data from lost hard drives, and in some cases forensics. – corsiKa – 2014-09-28T22:41:11.230
7Windows Vista, 7, and 8 (and 8.1) use $RECYCLE.BIN. @Riking You're thinking of Nautilus for Linux; it uses .Trashes. – Cole Johnson – 2014-09-29T03:52:27.320
3Although it's file-system dependent, file names are not usually removed from the folder upon deletion. e.g. in FAT/FAT32 just the first character of the filename in the dirent is replaced with an 0xE0 byte making the entire file including all but the first character of the name entirely recoverable if no writes have taken place that reuse the cluster chain that was previously allocated to the deleted file. – Andy Brown – 2014-09-29T07:58:18.763
Are you sure that it 'moves' the file contents to the new directory called 'Recycle Bin'. In which case, deleting a single 2GB file must be slower than deleting 300 20kb files right? – Yaitzme – 2014-09-29T08:35:55.123
6@Yaitzme moving a file does not generally move the contents of a file. If the source and destination are on the same partition, only the name of the file is moved (i.e. a pointer to the file is added to the new directory, and deleted from the old directory). The data can stay in the same place. Only when you move a file across partitions do you need to copy all the contents. – amon – 2014-09-29T08:52:25.070
Oh yeahh. Damn, I actually knew this. But it would've been more clear if this had been detailed in the answer.
And is this why Windows has a Recycle Bin in every drive? – Yaitzme – 2014-09-29T08:55:14.940
Moving the file to a recycle bin on another drive or partition would be a very costly operation. So yes, this is why Windows keeps a hidden recycle bin at the root of each partition. – nullability – 2014-09-29T19:45:36.637
In Mac OS X, there's something called "Secure Empty Trash," which does a 1-pass overwrite, and the Disk Utility has a 7-pass overwrite, which is said to meet DOD 5220-22M. Anything like that in Windows 7 or 8? – Anthony – 2014-09-29T20:55:49.643
1@Anthony: not built into the OS AFAIK. Tools are available, but in any case overwriting the file doesn't actually guarantee anything about securely deleting the data. The file data might already be stored in multiple places (because of deliberate hidden copies such as Windows shadow copies or because the file has previously been relocated for example because of FS compression). The filesystem or the hardware might "re-write" the file in a new location instead of physically overwriting. That's why one is advised to securely delete whole partitions, not just single files. – Steve Jessop – 2014-09-30T16:25:04.877
36
A file is in two parts:
When a file is deleted:
Mary Biggs
Posted 2014-09-27T08:57:04.127
Reputation: 361
10
You need to clarify if you are asking what happens on the physical drive, or on the software level.
On the physical side, it depends on the drive:
On magnetic drives, overwriting bits, or writing them, is the same operation, so files usually don't get physically deleted (the operating system just changes the table of content of the partition and mark the space as free).
On SSD drives, it is not possible to write over existing data so files usually get physically deleted (See http://en.wikipedia.org/wiki/Trim_(computing) )
On the software, depends on the filesystem you are using, most of the time, only the table of content of the partition is changed.
Eloims
Posted 2014-09-27T08:57:04.127
Reputation: 201
4"Moving to the Recycle Bin moves the file." Not really. The file itself doesn't move; it still occupies the same LBAs on the disk as it did before. Even the file record is the same. The only thing "moved" is the directory entry, from the file's original directory to the directory for the "Recycle Bin". – Jamie Hanrahan – 2014-09-28T00:30:01.427
That thing about SSD is something I didn't expect. I thought all write operations in an SSD cause wear. Doesn't trim cause wear? You may want to mention that it's not the OS actively writing zeros on the space but just sending a trim command to the SSD which in turn clears the data from the sectors that held the file. – ADTC – 2014-09-28T01:29:14.120
what i wanted to say, but did not take the time to explain is that when asking this type of questions, you really need to narrow it down to either the software or hardware side of things. "files", "folders", "partitions", "table of content" etc all are software concepts. On the hardware side it's more like "read 80 bytes at address 0x2384923, "write 24 bytes at address 0x123123" or "trim 292 bytes at address 0x82478923" – Eloims – 2014-09-28T11:52:26.630
6AFAIK, The Trim command does not delete the file physically (as ADTC mentioned, this would be a costly operation. It just lets the drive's firmware know that it doesn't have to preserve the data anymore. So this is conceptually quite similar to what happens at the filesystem, just at the firmware level. – oefe – 2014-09-28T12:04:23.183
@ADTC: A typical hard drive will allow 512-byte sectors have their contents replaced with new data in arbitrary sequence. Writing a sector with all zeroes or all FFs is, from the drive's perspective, no different from writing it with any other combination of data. A typical high-density flash chips will be divided into groups of 64, 256, 1024, or more pages of 528 (not 512) bytes each; once a page is written, it cannot be written again until all pages in the same group have been erased. While it would be possible to modify a single page by... – supercat – 2014-09-28T18:08:28.060
...copying all pages in its group to RAM, erasing the group, modifying the page in RAM, erasing the group, and then writing everything back, that would be very slow. Instead, a flash drive given a request to write block 24601 will find an empty page somewhere and write the data along with an indication that it is block 24601. It will typically also have to update some other form of directory structure to allow block 24601 to be found efficiently [searching all eight million pages of a 4GB drive would be absurdly slow!) – supercat – 2014-09-28T18:10:36.787
2When the number of blank pages gets low enough, an SSD will search for a block which contains nothing but "obsolete" pages. If such a block is found, it will be deleted. Otherwise it will find the block that contains the most obsolete pages, copy a non-obsolete page to a remaining blank one, and mark the page as obsolete. Once this is done for all blocks on a page, that page will no longer contain any non-obsolete blocks and may thus be reclaimed. Note that if a file system thinks a page is useless, but the drive doesn't know that, it may waste time copying useless data. – supercat – 2014-09-28T18:12:59.253
@JamieHanrahan: you could say the same thing about any move operation, as long as it happens on the same partition. – njzk2 – 2014-09-29T14:36:56.213
@njzk2: No argument there! – Jamie Hanrahan – 2014-10-02T01:36:35.687
11Securitywise, ordinarily deleted files are recoverable partially or fully depending on the extent of overwrite. If you need to erase file data such that it's unrecoverable, you will need to use third party tools to "securely delete" the file and/or "securely erase" the disk free space. This involves writing zeros or random data once or many times over the space and it's time consuming (that's why the ordinary delete doesn't do it). – ADTC – 2014-09-28T01:36:12.763
@JaDogg What do you mean? – llllllllllllllllllllllllllllll – 2014-09-29T15:12:38.547
@JaDogg most of the 0/1 and what is it? A/F? Not sure, a bit rusty. But it all pertained to networking. The majority of it anyways. I'm new here so I can't comment on the other people posting questions about it as I haven't seen anyone else, but I don't doubt it. – Shea A. – 2014-09-29T15:37:30.293
You're wrong. When you "delete" something, Windows just moves it to the Recycle Bin, which is, basically, just a special folder. Even when you delete something from the Recycle Bin, it generally isn't overwritten immediately. (But the blocks become free to be allocated to other files, and then the data can be overwritten.) – G-Man Says 'Reinstate Monica' – 2014-10-09T22:36:11.673
@ADTC, It's just a normal write isn't it? So why do you need third party programs? If I resave the file as
000000000000orrandom_garbage_data_repeat_random_garbage_datbefore deleting, wouldn't that have the same effect? – Pacerier – 2015-07-09T05:01:44.103@Pacerier No, it wouldn't. Not always, anyway. When you save a file, you have absolutely no control over how the program is going to write your new saved file. Your everyday programs do not control how exactly the files are written on the hard disk, and therefore cannot ensure they will always be written in the same location. That is left to the operating system to decide, which naturally takes the most efficient means it is programmed to do. Third party tools fill the free space with zeros by doing low level writes on the hard disk, which is different from asking the OS to save a file. – ADTC – 2015-07-10T02:34:36.933
@Pacerier Assume you have a file that is written at sector A with the text "abcd1234". You open it in Notepad and replace the text with "00000000". When you save, Windows could write it out as a new file in sector B with text "00000000" and mark the old file as free space. The free space still contains your old text "abcd1234". Anyone reading the free space can see this text. The third party tool used to "secure erase" will find this free space and fill it with zeros, so that from then, anyone reading the free space will only find zeros, not your original text. – ADTC – 2015-07-10T02:38:15.453