How are law enforcement agencies able to retrieve data off of a device or sim etc. that has been erased/deleted, yet we cannot retrieve our own lost data? Isn’t the point of erasing something to completely erase it…
In: Technology
Deleting something doesn’t remove it from your hard drive. It marks the space that it takes up “free space” and when something else needs the space it will overwrite it. It isn’t until that point where it’s over written that it’s actually gone.
As for retrieving your own lost data, you absolutely can if you have the right programs and know what you’re doing.
You actually can recover it. You just need the right tools. It’s the digital equivalent of the pencil trick, looking for fragments of data that may not have fully gone away, references in other files, etc that may help you rebuild a file partially. The way to fully make it gone is to write over it, with new files.
TIL after deleting my browser history I need the person to also open hundreds of pages to overwrite the data /s
As others have said, you don’t erase it normally, it’s just marked as free space to write in. To completely erase it you need to write over it various times, shred the hard drive and then melt it
When you tell a computer to delete something, it usually isn’t actually removing the data from the device, it’s just taking it out of the index (a big list of data you have on the device that lets the computer find the data), and opening up the space it was stored in to be overwritten by new data. So until something else overwrites it, it’s still there if you have the equipment and/or software to find it. And if it’s partially overwritten, sometimes you can recover enough pieces to see what it was and rebuild it.
It’s done this way since it takes less time and energy to just open up an area of storage than it is to actually remove the data. And 99% of the time, that’s all you need. But if you want to completely delete data, you can use special software that overwrites the deleted data with random 1s and 0s to make sure there’s nothing left there to recover.
But even then, sometimes small amounts of data can still be recovered, depending on the device and how the random junk data was written. For example, a magnetic hard drive stores data with a thin disc of metal encased in glass, divided into tons of tiny sections. Each section will be magnetically aligned one way or another, and this is used to represent 1s and 0s and store data. If some data is in the same place on the drive for a long time, the metal can kinda become set with that specific pattern of magnetic alignment, for lack of a better phrase. Then, when you overwrite it, some tiny bits of the metal will still have that old pattern. Not enough for it to mess up the data you wanted to store, but enough that somebody with specialized equipment can find some of the deleted data if they know what they’re doing.
So, here’s the best way I can explain this. When you “delete” something, off of your device, it’s not actually being deleted. A programming function on your device is just choosing to ignore that particular data. If you happen to use that space up, however, it will be overwritten. Typically, devices don’t have built in software to allow access to “deleted” files, but you can actually just download stuff like that. There’s a ton of recovery software that exists out there.
The main answer to your question, then, is that law enforcement agencies have access to very good recovery software. The recovery aspect of their software is the same as you yourself could get, but their software often has elements that can attempt to bypass security. That’s why a lot of device manufacturers advertise their encryption technology, as it can help users feel more secure by attempting to block unwanted prying into your devices hidden files.
because deleting data only deletes the Address of that data, it doesn’t actually go to the physical data itself and take it away, because you can’t do that, in order to completely erase data, you need to replace it with new ones, i am not sure of the exact reason, but if for every time you press delete, the hard drive had to actually write new data over the old one and get rid of the address, i believe this will reduce the hard drive life by up to 70% maybe ? cause writing data is an actual physical task where a laser beam is literally engraving a disc (in the case of Hard Drives)
So the solution that OS writers opted for is instead of overwriting, they just mark that space as “available”, so that when new data comes they can use that space.
This allows you (or law enforcement) to use various programs that go through the data device “manually” and seek everything, they are called recovery softwares.
Latest Answers