Why does deleted data stay on a HDD once written, waiting to be overwritten, as opposed to being removed when requesting deletion?
In: 22
It takes a lot more time to go and remove the data, especially on older spinning discs
Got a 10 GB ripped bluray movie you don’t want any more? The way that we have deleting setup today it goes and clears the entries in the file time and makes the space as unclaimed. It changes a few bytes and can be done in a fraction of a second. If you want it to go overwrite the whole 10 GB file with 0s then it’d take the spinning hard drive about 2.5 minutes to complete the task during which time *you can’t get to anything else on the drive* without seriously slowing down the operation and whatever you wanted to do
Lots of rules were created to reflect the fact that HDDs are *slow*. A fast disk (15000 RPM Raptor drive) could do 80 MB/s but your normal bulk storage was in the 40-60 range. Modern discs with 4 or 6 ultra high density platters can do better but still rarely more than about 120 MB/s. Having to go through and erase a sector would have been a massive waste of time for no gain, anyone who cared about data destruction had an electromagnet to take care of that.
Overwriting files can take a lot of time, especially if the data to be overwritten is very large or spread out in many small pieces.
As such, it’s far faster just to erase a file table entry pointing to that data and move on.
Unless there’s a security reason to need to wipe the data so none of it can be found, it’s a lot faster to not bother and instead just mark those parts of the disk as being freely available to overwrite with something else rather than being overwritten right now.
It’s like “who cares that these bytes aren’t all zero? You’re not using them anyway.” Later, when you do start using them, you’ll be replacing them with your new content anyway so you gain nothing by writing to them twice (once to blank them out and again to write something new.)
Imagine a wall with a mural.
You mark off a rectangular spot on the wall – a part of the mural you don’t mind clobbering with a new picture. You paint over it with white to blank it out, and then plan to let someone else paint a new picture on it later.
Well, instead of painting it over with white, you could have just marked the rectangle off with a border, and then not bothered to paint it over with white yet – just mark it as available. Let the person who’s going to paint something new there paint over it – don’t bother with the in-between step of painting it blank in the mean time. **This is essentially what disk drives do when you “erase” a file**. They just mark the space as “clobber-able” without actually bothering to clobber it yet, leaving that to happen later when some file needs the space and writes over the top of it.
It takes extra time to write over the top twice – once to blank it and once again later when putting something new there.
That being said, there are some secure filesystems that DO blank it when you erase, for use in places where the extra time is worth it for security.
An HDD is like a library. The data is written in a huge number of “books” called blocks, but all the blocks are only identified by numbers. To find something, you need to use a big index to know which information is in which book.
Your computer uses the index to keep track of which books are being used at any given time. If you delete the index entry for some information, two things happen. One, the computer no longer has any way to find which books contain that information. Two, the computer now thinks that those books are empty. Of course, if you were just waltzing through the library and picked up one of those books at random, you’d find all that info is still there. At some point, part or all of it may actually get deleted because the computer, thinking that those books are empty, will write some new information there. But there’s really no guarantee on how long it would take to completely overwrite some deleted data through average drive use. To really delete stuff you can use software that will just write empty data to all the books in a file before deleting its index record.
Thanks all. I now have more of an understanding of how relevant the file allocation table is to a hard drive and the calculation of available size etc. I’m learnding!
Gonna give a bit of a hand-wavey explanation, but it gets to the point.
Data in computers works using something called pointers and addresses.
Addresses are values that describe WHERE the data is. Data is physically stored at that address.
Pointers are values that point to that an address and can access that data stored there.
Usually when something is deleted from a hard drive, the pointer is deleted, and that address of the disk is marked as “available for other things to be stored there”.
Sometimes, data is deleted, but it just happens that nothing has been saved over that part of the disk yet, so the data is still physically there and could theoretically be retrieved.
Overwriting the addresses so that they contain “nothing” would take just as long as writing the data to begin with, so instead computers just delete the pointer to the data.
Think of a hard drive like a book with millions of pages (sectors).
You could go to each page and erase the text off it, however this takes a lot of time and adds wear to the pages. Often, the data won’t even be on pages next to each other, requiring you to jump around the book to find all the pages.
Or, you can just go into the index and erase the entry and figure nobody will look at the pages or be able to figure out the correct pattern.
There are “secure delete” tools that will do the former, but such functionality is not normally needed, and the extra cost is not worth it.
With actual HDDs, there is also leakage of the data slightly outside of where it’s supposed to be, which can sometimes be used to recover even overwritten data.
In a sense, there is no direct way to ‘remove’ data from a HDD.
You can *read* data, or you can *write* data.
For practical purposes you can consider data to be ‘deleted’ when you can no longer *read* it.
When you create a file, the computer *writes* data to the drive, including a note of what file is there, and a note to not *write* anything else there.
When you tell the computer to “delete” a file, it simply forgets that note of what file is there and the reservation not to *write* over it. Basically, it forgets how to *read* what was there, because that is the easiest way to make the data functionally ‘deleted’.
Now, you could instead *write* over the data with new data (like all 0s or all 1s). That would also make it unreadable. However that would take more time and electricity, and slow down your computer for uually no benefit, so we don’t bother with that. [If you need to keep secrets, this extra time and electricity might be worthwhile.]
Imagine you got one of those [bubble fidget toys](https://m.media-amazon.com/images/I/51yk1esQdgS._AC_SY580_.jpg) and you pop in a smiley face pattern on it. That’s kinda like having a HDD with memory saved on it in that it’s got spaces that are in one of two states, 1 or 0, or popped in or out in the case of the fidget toy.
You’re done making your smiley face so you hand it to your sibling, who wants to make a frowny face. Now they *could* first unpop all the spaces first then proceed to fill in spots to make a frony face, or they could just pop/unpop the spaces needed to make their frowny face. Since unpopping them all first takes extra time and doesn’t really help make the frowny face, it’s strictly a waste of time.
So data is written to a hard drive, but programs need a way to find that data afterward. So it’s given a signpost pointing to the location on the hard drive where it can find that data. When you delete something, it’s not actually deleted, but rather the signpost is. This lets the drive manager know that it can put up a new signpost to write new data. But that binary data – the zeroes and ones – remain where they are until they are overwritten by new zeroes and ones. This is more efficient because data typically does not need to be destroyed when no longer needed.
Manually deleting a hard drive, on the other hand, involves an extremely time-consuming process of changing *all* of the zeroes and ones in every space of the hard drive.
Latest Answers