Is it true that once files are deleted from the recycling bin (or “trash” via Mac), they remain stored somewhere on a hard drive? If so, wouldn’t this still fill up space?
If you can fully delete them, are the files actually destroyed in a sense?
In: Technology
They don’t go anywhere, the computer simply forgets where it is! The files and folders are then eventually overwritten when the computer rewrites over those sectors.
The file system have a few zones.
– file name table
– allocated sectors
– data zone
– other more advanced stuff not important for this
When you delete a file, it remove the name in the file name table, and mark the sectors as available in the allocated sector list.
The data stay there until you write more data and it happen that it need that space.
To make things even more unsafe, the data that say where the data is is also left behind intact!
This is how some undelete tools work: it scan the unused space for the data for where the actual data is.
Now, SSD drives add another layer: the drive can be told that the sectors are now unused, and the drive may preemptivelly erase the sectors. Unlike mechanical hard disk, SSD need to actually do a sector erase first, then write the data. Mechanical disks work with a magnetic media, which do not need a ‘reset’ first. SSD do the erase when it is idle, or told to explicitelly do it now. This does two things: make it faster by not having to erase first when you write to it, but also prolong the life of the SSD by allowing the drive to decide where to write the data. It would do it on the cell that have the less wear. If it do not trim then it don’t know where it can write, so it just write to the same place, and quickly wear one spot… The reality is more complex, but it give you an idea.
They don’t go anywhere. In the hard drives file system they’re simply market with a 1 or 0 which denotes deleted.
They’re still there and can be recovered until that spot in said hard drive is saved over by another file.
Lots of answers, but I’ll throw mine into the ring as well.
If you didn’t know, everything is saved on the hard drive as a series of 1s and 0s. The space on a hard drive is like number line. Each file has a marker that specifies where on the number line the file starts and ends. Different size files just take up more space on the number line.
Every hard drive has an index, or address book, that tells where each file begins and ends. For example, you have Space Balls.mp4 saved on your computer. The index states the Space Balls.mp4 starts at position 16,000 on the number line and takes up 2,000 spaces. This means that spaces 16,000 through 18,000 are a set of 1s and 0s reserved for the file cannot be used.
When you decide to delete Space Balls, you don’t actually delete the information on the number line from 16,000 to 18,000. The index/address book just says that space is available for a new file. But the 1s and 0s are still there and still in their original order. The next time you create a new file, the index will start at 16,000 on the number line and take up as much space as needed. If it is a small file, it might only take space on the number line up to 16,400. If the file is too big to fit in 2,000 spaces, it will get split, sometimes in lots of pieces. This is called fragmentation and it destroys hard drive performance. It’s not really an issue any more since newer operation systems defragment in the background. SSDs (solid state drives) don’t have a problem with fragmentation since there are no moving parts, its just grid of storage units. Hard drive vs SSD performance can be compared to memorizing everyone phone number for every person in your town vs having to look it up in a phone book. It is that drastic of a performance increase.
Anyway, you can delete the index/address book and not actually lose information. This is called a quick format and all that does is reset the index. You can hook up that drive up to another computer and run a recovery program and get most, if not all, of your files back as long as you did not start writing new files. If you really want to erase the files on your drive, there are programs that will “wipe” your drive. They start at the beginning of the number line and write every spot as a 0, start back at the begging and write every spot as a 1. When I wipe drives at work, I use a program that does 3 passes. It does all 0s, then 1s,random 0s and 1s, then verifies it all ran as expected. It is/was the US Department of Defense recommended method for scrubbing a drive.
https://www.blancco.com/blog-dod-5220-22-m-wiping-standard-method/
Basically, your computer has a list of all the files on the disk and where they are on the hard drive. When you delete a file, it just gets removed from the list, but the data remains on the drive. The next time a file is created, the OS will try to fill the gap by writing in the space that it no longer considers to be occupied by the old file.
Everyone mentioning that computers, or drives don’t actually delete the file when you delete it is correct. In this sense, the chunks on the drive are marked unused so that they can be overwritten later.
However, I wanted to add a bit about why. It’s perfectly possible for a computer to delete a file by zeroing or writing random data to that part of the drive, but it’s done in the interest of speed.
***Fair warning, this is a bit more technical, and while I’ll try to make this easy to understand with no background, it might go slightly higher level than ELI5***
On a mechanical hard drive, this physical moving of the read/write head to write that data takes time. Just the same amount of time it would take to copy that file somewhere, since that’s basically the amount of data we’d be writing. From a mechanical hard drive standpoint, this potentially takes a long time, so they just mark the chunk of the disk as unused.
In terms of an SSD, we’re not waiting for a drive to physically move, or for the data to spin past a read head, since it’s all electronic. The issue is that on an SSD, the drive isn’t just discrete 1’s and 0’s. The flash memory that’s in an SSD carves the storage on it into logical blocks that consist of larger chunks of data.
Say for example, a block can hold 1000 bits of data. If you have a string 8 bits long, on a mechanical hard drive, you just have to zero those 8 bits. The problem is that an SSD can only read and write blocks of data. So for an SSD, even though there’s no physical wait time, it can’t just zero 8 bits. It has to find the block containing this data, read the entire block into memory, modify the 8 bits in question, and then rewrite the entire block. This, while still being faster than a hard drive in most cases, is painfully slow by SSD speed standards, since it has to work with much more data than the amount that’s being modified, and it has to both read and write that entire chunk.
## Bonus
If you’d like to get technical, this is why there’s a process on SSDs called TRIM. When your computer can support working with TRIM on SSDs, the SSD does the same thing a hard drive does, and marks this data unused. Now, because modifying an existing block is much slower than just writing to a block it knows is empty, what an SSD will do with TRIM (which happens in the background) is consolidate this data. Suppose you have 10 blocks of data. Each of them, like before, hold 1000 bits of data. Now suppose that 8 of these have data partially written to them. Say, 300 bits each. That’s 2400 bits of data, but spread over 8 blocks, so we only have 2 blocks that are empty (and as such, don’t need to be read and modified, so the SSD can just write directly to those without reading them first). If we have a file that’s 5000 bits, that won’t fit on the 2000 bits contained in those two empty blocks, so this would ordinarily be really slow because it would have to read, modify, and write at least 3 other blocks to store this new file.
If, however, we let TRIM operate in the background, it’ll go through when your drive is idle (if you’re browsing the internet, and not using a lot of the drive speed, for example), and consolidate that. So it’ll see that we have 2400 bits of data across 8 sectors of 1000 bits, and it’ll see that the rest is free space, so it’ll read those into memory, consolidate them, and write the data back. The end result is that we end up with 3 sectors, 2 are the full 1000 bits, and the third is the remaining 400. The other 5 sectors are zeroed and marked empty. This means that if we were to then add our 5000 bit file, instead of the performance hit and time it would take to read and modify a bunch of partial blocks on the SSD, it can just write that 5000 bits to 5 already empty sectors.
A zero gets added to the front of the file, which tells the computer to pretend that’s it’s deleted, and the file is in limbo until the computer needs the space that the deleted file is taking up, and it will write over it.
Basically, imagine renting a house. You live there, it’s your address.
One day the landlord comes in and says “I’m evicting you. I’m ending the contract. As of right now, you no longer live here. But you’re welcome to stay here until a new renter comes along and needs this house. When that happens, you’re gone”
So, even though your rent contact was terminated, and you had to publicly change your address to nothing, as you are homeless now. No one knows you live there anymore, but you stay there, occupying the space until you get replaced by a new renter when the space is needed.
Please, if you read this, and I’m not correct, don’t tear my ass up. It’s been a while since I’ve learned how files are deleted, so I’m just making my best guess.
Nowhere. The file is hidden with the filename prepended with a special character that the OS hides. It is then “available” to be overwritten
No where. They are just marked as writable. So you can save things over them, replacing the code essentially. This is why forensics can still find old bits of data even after it’s been deleted.
Imagine you have a filing cabinet that is just a bunch of numbered pieces of paper with information. Your file might be on page #8,235,17,992. There is a master page that says what pages to find your file. When your file gets deleted that master page is erased. Pages 8,235,17,992 are still there with your stuff, but the next master page can use them and overwrite them.
Latest Answers