Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

How Were Files Recovered that I Thought Were Deleted?

Gone, but not forgotten.

I Thought I Deleted That File
(Image: canva.com)
Files may be gone, but frequently are not forgotten. Depending on the scenario, files you thought were deleted might be easily recovered.
My son brought up some files in my computer that I had deleted, such as emails on my yahoo account, deleted photos and deleted conversations on yahoo messenger. How is this possible and where do I go in my computer to get rid of that information and how do I prevent this from happening again?

I usually get the reverse of this question: “How do I recover files I deleted?” But it’s worth understanding how things can be recovered so that if you want something to be deleted “for real”, you can take appropriate steps.

Become a Patron of Ask Leo! and go ad-free!

TL;DR:

Common reasons files might be recovered

  • Applications may not delete files immediately.
  • “Deleting” may mean moving to a Recycle Bin.
  • Special tools can often recover data not yet overwritten.
  • The file was copied into a backup.

It’s not really deleted

One example is your web browser’s cache. I suspect that’s responsible for most of what you’re seeing.

People are often surprised at the files, pages, and images left behind after you’ve browsed the web for a while.

Browsers make use of what’s called a “cache”, a place where files can be downloaded once and kept “for a while” so if you need to view the file again, it need not be downloaded again.

A good example is the Ask Leo! logo at the top of this page. The first time you visit Ask Leo!, it’s downloaded and shown to you, but also placed in your browser cache. Then, when you visit a different page that references the same image, there’s no need to get it again, it’s already in your cache. The result is a faster experience.

Days or sometimes even weeks later, you’ll still find those images in your browser’s cache. If you don’t recall visiting the site, you’ll wonder where they came from.

Anything you visit on the web may be saved in your browser’s cache. In addition, anything you viewed in email could be there as well, as some email programs use the browser cache for caches of their own when viewing pictures, HTML emails, or attachments.

The browser cache is just one example. Different programs manage their data in different ways, and can easily decide not to delete or clean things up until sometime later based on whatever that program decides is important.

It’s deleted — but no

Two words: Recycle Bin.

When you delete a file using Windows File Explorer, it’s typically not really deleted. Instead, it’s moved into the Recycle Bin. The Recycle Bin is then managed separately, and files are physically deleted only when the bin becomes full or you manually empty it.

The point, of course, is to allow you to say “oops” and recover a file from the Recycle Bin if you delete one by mistake.

The side effect is that the files are still on your machine until the Recycle Bin is emptied.

This same approach is occasionally used by other programs. Email programs or interfaces often have their own Recycle Bin into which they move deleted messages.

It’s really deleted, but . . .

When a file is deleted, the contents of the file remains behind.

It’s kind of like moving out of an apartment by just taking your name off the door; you might still be in there, but no one can find you.

But they can find you by checking every unlabeled apartment. Only if someone else has moved into your old apartment will you and your stuff truly be gone.

The same is sort of true for deleted files. Deleting a file just removes the file’s name from the list of files on the drive. It’s not until another file “moves in” and overwrites the data that it’s actually gone. And naturally, there are tools that will search for and reconstruct files whose data has not yet been overwritten.

It was backed up

This isn’t part of the scenario you described, but it’s one that people overlook all the time: backups.

If you back up your machine regularly — as you should — then the files that were on the machine at the time of the backup have been copied and preserved in that backup.

This is a great thing if you accidentally delete a file and need to recover it. Just grab it from the latest backup on which that file existed.

This might be a bad thing if you need to ensure that a file is really and truly gone. You need to somehow deal with the backups on which it might remain.

Making sure gone is gone

So the question is, what do you do to ensure that when you delete something it’s really gone? Several steps, all following from the scenarios above:

  • Understand how your application handles files, and either configure it to not keep files around, or manually force them to be really deleted. In the case of web browsers, that means clearing the cache.
  • Empty the Recycle Bin. You could go so far as to disable it if you’re very concerned, but it’s probably enough to reduce the size of the Recycle Bin and/or empty it manually as needed.
  • Use a secure delete tool to either overwrite the “unused” space on your hard disk or to delete files and erase the space they used on the spot.

Further incantations to raise the dead

No discussion of data security and recovery would be complete without briefly discussing high-tech low-level data recovery.

Particularly on magnetic media like traditional spinning platter HDDs, after data has been overwritten once by other data — and even by a secure delete utility — it’s theoretically possible to send a drive in for detailed (and expensive) recovery that might uncover and restore previously overwritten data.

Again, it’s not part of the scenario you described, since it involves removing the hard disk drive and taking it apart. Prevention is relatively simple: either store your data encrypted or make sure to use a multiple-overwrite feature of your secure delete program.

Overwriting the data even twice makes the original data nearly unrecoverable.

Subscribe to Confident Computing! Tech problem solving & safety tips & a weekly confidence boost in your inbox every week.

I'll see you there!

10 Reasons Your Computer is Slow

Slow Computer?

Speed up with my special report: 10 Reasons Your Computer is Slow, now updated for Windows 10.

NOW: name your own price! You decide how much to pay -- and yes, that means you can get this report completely free if you so choose. Get your copy now!

11 comments on “How Were Files Recovered that I Thought Were Deleted?”

  1. Add my name to the large chorus of your fans….just want to mention here that your analogy of the vacant apartment with furniture remaining, but the name tag being gone from the door is superb. Even online banking which is supposed to be encrypted, triggers my paranoid need to “wipe the free space”….I often wondered why the “free space” needed wiping if it was indeed “free”.
    Why, oh why, has such free (pun alert) use of truncated language been so successfully programmed?
    No response needed, it’s a rhetorical question without any real answer.

    Best Regards.

    Reply
  2. Is the Windows Cache the same as temporary internet file folder?

    Depends on the context where you’re hearing it, but in general, no.

    – Leo
    04-Mar-2009
    Reply
  3. I should add, that all your files and the rest of the system are in the shadowstorage for as long as the shadows (recovery points) are not being overwritten by more recent shadows. And that can take a several weeks with a large OS disk partition. But that can also be a blessing if you need to recover files that were accidently deleted. If you like to know more about it, have a look at my little tutorial here http://www.winvistaclub.com/forum/windows-tips-tutorials-articles/26995-recover-lost-files-shadow-explorer.html

    Reply
  4. Well,I have been using System Mechanic Software to delete all the temporary files,is it possible that the files which are being deleted are removed permanently.

    You’d have to find out from System Mechanic how they delete files. My guess is they do it the quick way, which means that the files might still be recoverable. Using SDelete afterwards to thoroughly overwrite unused space would take care of it.

    – Leo
    04-Mar-2009
    Reply
  5. I believe the Ram in your computer also stores information, if that is correct how do you clear that?

    RAM is cleared the moment you turn your computer off.

    – Leo
    04-Mar-2009
    Reply
  6. Firstly make sure you do not change the disk or drive on which the files are deleted.

    Then you should check your Recycle Bin and see if the files you want is inside it. If not, then you can resort to some apps designed specifically for recovering deleted files. Such as Advanced NTFS Undelete at http://www.ntfs-undelete.com or EasyRecovery at http://www.ontrack.com. There can be many by searching on Google.com or Yahoo.com, but I only recommend the above two which are proved to be the best among the all.

    Reply

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.