Edit:
Fantastic answers, thanks all for the insight!
In: Technology
Usually, when a file gets deleted, the only thing the computer does is it throws a tarp over the data and hangs a sign on it saying “VACANT”. All the data is still there. This is why deleting even really huge files is basically instant, because nothing actually got deleted, it just got flagged as vacant space.
When you use programs that inspect your computer’s storage, they have to trust the operating system to tell them which files are actually there or not. When the OS sees the “VACANT” sign, it skips it over and reports no files there to programs. If a program wants to write new data there, the OS will happily write new data completely over the old stuff as if it wasn’t even there.
There are special programs that don’t go through the operating system’s normal channels and check the storage directly themselves. They see the “VACANT” sign and instead of pretending there are no files there, they cast off the tarp and find all the old data.
If you want to truly delete a file, you have to tell the operating system to not only mark the data as vacant, but to write new data over top of all the old stuff. Manually erase it. You can write whatever you want, but customarily one would write a bunch of binary zeroes over the old data. Doing this is often referred to as “zeroing” the drive.
In some cases even this doesn’t fully delete the data, though. On spinning hard disk drives, the platters that store the data store it as tiny magnetic charges all next to one another. Writing new data on the disk over top of old data in theory should flip the charges around perfectly, but it’s not always so perfect. A shadow of the old data can be found on the old drive if you inspect it with very special tools. This technique can be used to recover data from platters that have even been zeroed out the long way.
One also has to be worried about so-called “bad sectors”. That is, chunks of the disk are reported to the computer as corrupted, failed, or damaged, rendering them inaccessible by normal means. Any data that is in a sector that goes bad will basically stay there (assuming it isn’t damaged by whatever caused the sector to fail). Special tools can scan these failed sectors and recover data left on these too.
If you want to defeat these kinds of data necromancy from ever bringing your data back, you may want to zero-out up to a dozen times in a row or more. Or you can just straight up physically shred your drive platters into bits or destroy it by other means. Completely destroying the physical disk is the only way to ensure beyond any doubt that the data is truly gone. It’s just more time consuming to do, especially at the scale of a large office that could be dumping hundreds of these things all at once, so it rarely gets done.
So no, this isn’t entirely Hollywood trickery. If it’s the first kind of deleted data I mentioned, this is something you can easily do at home with some readily available software. The other, more specific kind of data recovery is also possible, but I understand it is very expensive and doesn’t always work. The exact nature of the recovery might be embellished for a show narrative, as all things often are, but it is rooted in some reality.
Latest Answers