Sent to the Recycle Bin
When we delete a file on a computer, the file will be "moved" to Recycle Bin, Trash or something with the similar name depending on your operating system. Recycle Bin functions as a failsafe in case users accidentally delete useful files. In windows, for example, you can go to the Recycle Bin and restore the files you inadvertently deleted.
These deleted files are not deleted actually. They are marked as deleted by the file system and become latent to users. In Windows Vista and above with NTFS, each drive has a $Recycle.Bin special folder under it, which normally is set to Hidden. Deleted files’ information is recorded and stored in these $Recycle.Bin folders. Desktop Recycle bin collects information from these separate $Recycle.Bin folders and presents them to users so users can view, restore or "permanent delete" these files.
Emptied from Recycle Bin
When we emptied the Recycle Bin, those files will be considered permanently deleted by the file system. Once the headers, or file references, are removed, the operating system will no longer be able to locate these files. The spaces the files are taking will be marked as "not in use".However, removing references still doesn't mean the permanent removal of files.
Deleted files aren't removed permanently until they got overwritten by new files. Why won't the system just delete them right away? Because to permanently remove a file requires the file to be overwritten. That means each time you delete a file, the system will overwrite the file with random 0s and 1s. This is time-consuming and inefficient. The larger the deleted file, the longer it will take to overwrite. Just think about the painful waiting each time you copy a huge file. This is the base of consumer level data recovery software technology - they employ special algorithms to search and rebuild the file header to make the deleted files accessible again.
Digitally Shredded files
Because of the fact that normal deletion does not remove the raw data of files, special cares should be taken when dealing with sensitive information and recycling old storage devices. For users with specific security requirements, there are tools available to erase files permanently in case of unauthorized recovery.
A file shredding program uses algorithms to overwrite certain files over and over again with other data till the trace or data remanence can no longer be recognized or recovered. It is in nature overwriting. We call it shredding in an analogy with traditional paper shredding machines, which are used for disposing of sensitive documents.
Formatted Drives
We all know once a drive is formatted, all files stored on that drive will be deleted. But there's more to it.
A quick format just resets/rebuilds the file system, leaving data mostly untouched. We can recover files from a quick-formatted drive with the right tools.
A full format will reset the data by overwriting the whole drive. Files will not likely to be recovered from a full-formatted drive. This is very useful when you are disposing of or recycling your hard drives containing sensitive or personal information.
Regarding SSD
SSD works differently as traditional hard disk drives and the read/write cycles of SSD flash memories are limited so there could be some exceptions regarding SSDs.
1. Trim Enabled SSDs will erase deleted files to make space for future new data. Data can only be written to blank spaces on SSD, which means new data cannot simply overwrite old files. Trim marks deleted or invalid data so that the Garbage Collection process will remove these files to improve speed and lifespan.
2. Because of the finite read/write cycles, wear-leveling is featured on SSDs. WL moves files around to avoid certain parts of the memory deteriorating faster that other parts. This makes file shredding on SSDs almost impossible because we have no idea where the SSD is going to put these data, let alone overwriting particular data.
No comments:
Post a Comment