Why does deleted data stay on a HDD once written, waiting to be overwritten, as opposed to being removed when requesting deletion?
In: 22
What we call deletion is actually just “freeing up” space that was originally allocated to a file. The whole concept of files and creating them and deleting them is all conceptual in software. There isn’t actually such a thing as deletion or even files on a physical level on a hard drive, memory or whatever that’s functioning as it should. The disk is already “full” from the day it rolls off the production line (or in the case of RAM, when it has power). You can’t physically remove a 0, and all writing is just overwriting what’s already there so why bother doing that right now when you’ll have to do it later anyway?
Think of how we divide up private land and build houses and farm it and keep animals and grow crops on it, or maintain parkland. That ownership is a human concept; the flora and fauna and dirt and rocks on the land are affected by it, but they have no concept of the made-up lines we impose on it, and existed before and will continue to exist after anyone claims ownership of it, until the next person comes along and changes it all up.
You can’t remove data. There’s always a state. You can only change the state/overwrite existing data.
For almost all purposes, freeing up the space on the drive for reuse is good enough. As others have said, the way you do that is to simply take the entries out of the file table. Tiny fractions of a second to do versus minutes for large files. You secure the “deleted” data by securing the computer, and implicitly its drives. And if you can’t do that, perhaps you ought to ask why you’re putting data on it that needs to be totally removed?
If you REALLY want to overwrite files, you can either wipe the whole drive or use “eraser” software to do so at the file level.
Having said that – it’s worth pointing out that, for magnetic media and with the right forensic tools, even after a full wipe it’s still potentially possible to recover at least parts of the “deleted” data. (Like any physical mechanism, drive heads have a degree of tolerance in their operation, meaning that they can only be so accurate in their positioning – so simply overwriting a bit with a new one doesn’t guarantee that the old magnetic pattern is actually fully replaced.)
Computers do two main things on storage: read and write. Both these things can only be done so fast. Bigger files require more reading and writing than small ones.
The reason the actual file isn’t removed is because that requires writing over all the data which means it would take a long time for big files. So whenever something gets deleted, instead of actually removing the data, the computer just pretends it doesn’t exist.
It isn’t ‘waiting’. When you delete a file, in reality you are just telling your PC it doesn’t need to store that data’s location in an index anymore. Without the location, your PC can’t ‘see’ the data anymore. All it sees is that there is available space to write to. It doesn’t matter in the slightest if there was data there previously or not. It will take the same amount of time to overwrite discarded data as it would to overwrite all 0s (no data). So instead of taking the time to clear the old data (overwrite old data with all 0s) then write in the new data (which would be writing to the same space twice), it will just overwrite it with new data (only writing once). Your PC doesn’t know when it is overwriting old data, it just writes to available space, whether it was used before or not.
Every method of storing data is essentially just a pile of tiny switches that can either be on or off. We store data by setting the switches a certain way and leaving them there. Removing data on deletion would require going to the pile of switches that represent your data and flipping them in some way that makes it impossible or at least very hard to guess whether each one was on or off before. That takes a lot of time. That’s why instead we just say that something being deleted means it’s safe to use those switches for something else. That also has the added benefit of allowing data restoration in certain cases if you decide you didn’t actually want to delete the thing. Since the switches never got flipped, if you can figure out which switches had your data you can get it back.
It’s easier to delete the ‘address’ of the code then deleting the code itself. It’s just an extra step to delete the first set. So it’ll reassign the address after a while to something else and just write over the old info.
Take a book. It has a glossary with page numbers. That’s like a hdd. When you erase data you just erase the glossary that points to the info. Saves time and the life of the hdd. You could do a thorough erase and it’ll erase and rewrite and erase again all the data
The primary reason is speed. During a normal delete the only thing actually deleted is the pointers to file, the data is still there unless you specifically trigger some process to overwrite the data.
Interestingly for quite a while computer forensics folks have know that they can recover data from magnetic media (like a traditional hard-drive) even if its been completely overwritten. Presumably this is possible because of subtle differences in the magnetic ones and zeros that are still left behind in the analog signal. So good hard drive wiping software will overwrite data with consecutive ones and zeros as with as many as five iterations.
It’s unnecessary to overwrite the data, and doing so wastes time and causes wear on the drive. This is doubly true if the data is encrypted and isn’t readable without a key (like most computers used in business these days).
If someone wanted to overwrite the file, they could.
Latest Answers