How Were Files Recovered that I Thought Were Deleted?

Gone, but not forgotten.

I usually get the reverse of this question: “How do I recover files I deleted?” But it’s worth understanding how things can be recovered so that if you want something to be deleted “for real”, you can take appropriate steps.

Common reasons files might be recovered

• Applications may not delete files immediately.
• “Deleting” may mean moving to a Recycle Bin.
• Special tools can often recover data not yet overwritten.
• The file was copied into a backup.

It’s not really deleted

One example is your web browser’s cache. I suspect that’s responsible for most of what you’re seeing.

People are often surprised at the files, pages, and images left behind after you’ve browsed the web for a while.

Browsers make use of what’s called a “cache”, a place where files can be downloaded once and kept “for a while” so if you need to view the file again, it need not be downloaded again.

A good example is the Ask Leo! logo at the top of this page. The first time you visit Ask Leo!, it’s downloaded and shown to you, but also placed in your browser cache. Then, when you visit a different page that references the same image, there’s no need to get it again, it’s already in your cache. The result is a faster experience.

Days or sometimes even weeks later, you’ll still find those images in your browser’s cache. If you don’t recall visiting the site, you’ll wonder where they came from.

Anything you visit on the web may be saved in your browser’s cache. In addition, anything you viewed in email could be there as well, as some email programs use the browser cache for caches of their own when viewing pictures, HTML emails, or attachments.

The browser cache is just one example. Different programs manage their data in different ways, and can easily decide not to delete or clean things up until sometime later based on whatever that program decides is important.

It’s deleted — but no

Two words: Recycle Bin.

When you delete a file using Windows File Explorer, it’s typically not really deleted. Instead, it’s moved into the Recycle Bin. The Recycle Bin is then managed separately, and files are physically deleted only when the bin becomes full or you manually empty it.

The point, of course, is to allow you to say “oops” and recover a file from the Recycle Bin if you delete one by mistake.

The side effect is that the files are still on your machine until the Recycle Bin is emptied.

This same approach is occasionally used by other programs. Email programs or interfaces often have their own Recycle Bin into which they move deleted messages.

It’s really deleted, but . . .

When a file is deleted, the contents of the file remains behind.

It’s kind of like moving out of an apartment by just taking your name off the door; you might still be in there, but no one can find you.

But they can find you by checking every unlabeled apartment. Only if someone else has moved into your old apartment will you and your stuff truly be gone.

The same is sort of true for deleted files. Deleting a file just removes the file’s name from the list of files on the drive. It’s not until another file “moves in” and overwrites the data that it’s actually gone. And naturally, there are tools that will search for and reconstruct files whose data has not yet been overwritten.

It was backed up

This isn’t part of the scenario you described, but it’s one that people overlook all the time: backups.

If you back up your machine regularly — as you should — then the files that were on the machine at the time of the backup have been copied and preserved in that backup.

This is a great thing if you accidentally delete a file and need to recover it. Just grab it from the latest backup on which that file existed.

This might be a bad thing if you need to ensure that a file is really and truly gone. You need to somehow deal with the backups on which it might remain.

Making sure gone is gone

So the question is, what do you do to ensure that when you delete something it’s really gone? Several steps, all following from the scenarios above:

• Understand how your application handles files, and either configure it to not keep files around, or manually force them to be really deleted. In the case of web browsers, that means clearing the cache.
• Empty the Recycle Bin. You could go so far as to disable it if you’re very concerned, but it’s probably enough to reduce the size of the Recycle Bin and/or empty it manually as needed.
• Use a secure delete tool to either overwrite the “unused” space on your hard disk or to delete files and erase the space they used on the spot.

Further incantations to raise the dead

No discussion of data security and recovery would be complete without briefly discussing high-tech low-level data recovery.

Particularly on magnetic media like traditional spinning platter HDDs, after data has been overwritten once by other data — and even by a secure delete utility — it’s theoretically possible to send a drive in for detailed (and expensive) recovery that might uncover and restore previously overwritten data.

Again, it’s not part of the scenario you described, since it involves removing the hard disk drive and taking it apart. Prevention is relatively simple: either store your data encrypted or make sure to use a multiple-overwrite feature of your secure delete program.

Overwriting the data even twice makes the original data nearly unrecoverable.