Manisha Thotagammana, Software Engineer from LK Domain Registry, was at ITN Digital to talk about Understanding File Deletion.
When you delete a file, do you actually erase it? Surprisingly, not always. What appears to be gone from your computer may still exist on its storage device, potentially recoverable by someone with the right tools.
When you save a file, your computer records its data and maintains file-system information that tells it where the data is stored. When you delete it, the system typically marks that storage space as available for reuse rather than immediately erasing every underlying data block. Until that space is overwritten or otherwise sanitised, some of the original information may remain recoverable. This is why even emptying the Recycle Bin, using Shift+Delete, or performing a quick format does not necessarily remove your data permanently.
However, the recovery process depends on the storage technology. On traditional hard disk drives (HDDs), deleted data can often remain until overwritten. Solid-state drives (SSDs) work differently. Features such as TRIM allow the operating system to notify the drive that certain blocks are no longer needed, enabling the drive to manage and clear them. This can make recovery significantly more difficult.
Specialised recovery and digital forensic tools can sometimes retrieve deleted files by examining file-system remnants or scanning raw storage for recognisable file signatures.
The privacy implications are significant. A 2003 study by MIT researchers Simson Garfinkel and Abhi Shelat examined 158 second-hand hard drives and uncovered thousands of credit card numbers, medical records, financial documents, and personal emails. Only 12 drives had been properly sanitised.
So, what should you do before selling, donating, or disposing of an old device? Simply deleting files or formatting a drive is not enough. Use an appropriate secure sanitisation method designed for your storage device. For SSDs, this may involve manufacturer-supported secure erase or cryptographic erase procedures. Full-device encryption, using technologies such as BitLocker or FileVault, also provides an important layer of protection when correctly implemented.
The key takeaway is that deleting a file is not the same as permanently erasing its data. Protecting your privacy means knowing how your information is stored, how it can be recovered, and how to securely erase it before your device changes hands.
