Where Do Deleted Files Go?

Break out the pencil and paper.

This is one of those things many of us take for granted or don’t think too much about. It’s a basic question, but it’s also very valid.

When something is deleted, it goes… away. Nowhere. It’s gone. And that can be hard to visualize.

It’s time for a metaphor.

Where deleted files go

When you delete something, it doesn’t “go” anywhere; it just becomes inaccessible. Deleted files are marked as deleted, leaving their data recoverable until overwritten. Secure deletion overwrites the data to prevent recovery. Regardless, always back up important files to avoid relying on recovery methods that are not guaranteed to work.

First: when delete isn’t delete

I have to start by pointing out that not everything labeled “delete” actually deletes anything.

Say you delete a file in Windows File Explorer. In most cases, that file isn’t really deleted; it is moved to the Recycle Bin.

Most operating systems as well as some cloud storage services work similarly, and the same is often true in email. When you delete an email, it’s often simply moved to a Recycle Bin or Trash folder.

Eventually, the file or email will be “permanently” deleted. That’s what we’re interested in.

Metaphors are imperfect

I hate having to lead with this, but remember that metaphors are always imperfect. They’re simulations or analogies, usually for the higher-level parts of some complicated concept.

I say that because of the pedants:1 the folks who will immediately respond to the explanation with “yeahbutwhatabout” or “yaknownotreally” kind of responses.

Unless I’ve made what you consider an error, let’s not pick the metaphor apart, OK? That can leave the intended audience more confused than when they started.

Besides, my metaphors are usually kinda silly, anyway.

Grab paper and pencil

Literally: get a sheet or two of paper, and your good old #2 pencil.

Write something on the paper. The phrase “Ask Leo!” appeals to me.

This is our “file”.

Now, grab a good old-fashioned eraser, and erase what you just wrote.

That’s deletion in a nutshell. What was there before didn’t go anywhere; it’s just gone.

That oversimplifies the concept, but it is a good approximation of where your file went: nowhere.

If we extend the metaphor just a little, we can clarify some things you’ve heard about deleting files on a computer.

Extending the metaphor

On a new sheet of paper, write a title followed by some text.

In this case, the title is “My Question” and the text is the beginning of the question at the top of the page.

For this extension of our metaphor, the title is equivalent to the filename and the text is equivalent to the contents of the file.

What happens when we delete this file?

When you delete a file, it’s roughly equivalent to erasing the file’s name.2 The data remains on the disk. This is what we mean when we say that deleting a file doesn’t actually erase the data.

This is also why we say that it is sometimes possible to un-delete a file. An undelete utility might be able to locate that data, reconstruct the file’s name, and give you back your file in working order.

Why only sometimes?

Overwriting a deleted file

Let’s say we’re going to create a new file over the last one. For the sake of our metaphor, an “overwrite” is the equivalent of taking out our pencil eraser and erasing what was there before writing new data in its place.

The title/filename will be “New File Name” and it will contain some different text.

Our new file name has overwritten the place where the original file’s name was, and the data in our new file has overwritten some, but not all, of the original file’s content.

This is why we say that data may be recoverable as long as nothing new has been written to the disk. The chances of recovering deleted data decrease the more data is written to that disk, potentially overwriting the original data.

But wait, there’s more. We can extend our metaphor a little further to account for the ghosts of data past.

Advanced forensic data recovery

If you look closely at the new file we created above, you’ll notice something interesting.

The previously written text is still faintly visible. Even where new text has been written on top of it, you can make out that something else was there before. Not unlike using a pencil eraser.

(This applies only to magnetic media (spinning HDDs), where overwriting information can leave traces of the information that was previously there.)

This is where advanced forensic data recovery comes into play. Using special tools operating on the physical media removed from the drive, it’s sometimes possible to analyze the heck out of those ghost images, and maybe, just maybe, recover what was written there before.

Maybe.

So, what if you wanted to ensure that wasn’t possible?

Secure deletion and free-space wiping

In short, you overwrite the data multiple times, making a complete jumble of the ghosts that used to be there.

When you use a secure delete utility to delete a file, that’s what it does. A free-space-wiping utility does the same to areas on a disk containing no data.

The result is something impossible to recover.

Here, my metaphor breaks in one practical regard: a disk won’t tear like the paper always did for me when I erased the same place too many times.

Podcast audio

Download (right-click, Save-As) (Duration: 8:33 — 7.9MB)

Subscribe: RSS

Related Video