Deleted items (Recycle Bin)
I have seen from time to time applications advertised that tell me they can 'remove deleted items from your computer'. Now my understanding is that a deleted item, once cleared in the Recycle Bin, has been removed. Going to machine code level, I read 'deleted' as meaning the 0 and 1 binaries that are put into sequences of 0 and 1 to make up the bits and bytes, which in turn are configured to create text, control characters, pixels, pictures, etc., in a file, are all set to zero. Setting the binaries to zero would regain the space previously occupied by the deleted items for future use. If that is not the case, then do the 'deleted' files still exist, sitting buried somewhere in my computer, like corpses interred in the earth ?
Modified by LJones
Chosen solution
Microsoft sets on files that you delete on the NTFS file system only one delete bit, but doesn't clear the data on the hard drive and also doesn't clear the MFT records and index data. Very small files (few hundred bytes) are stored entirely in the MFT and can thus always be recovered. Only when clusters that the deleted file occupies are reused to store other data then it isn't possible to recover a deleted file. On FAT32 (and FAT16) file systems this was more difficult, especially when a file is fragmented because on these file systems the bits that represent the cluster chain were cleared, so you had to be lucky that you could reconstruct the cluster chain. On NTFS is such a reconstruction not needed as you would only need to scan MFT. You would have to use a wipe utility on Windows to ensure that files with sensitive data are really gone and also do such a wipe if you would sell the computer.
Read this answer in context 👍 3All Replies (5)
'Quoting from an answer posted on SuperUser forum:'
Deleting a file from the Recycle Bin (or deleting it directly using Shift+Delete) removes the filename entry from its folder. The part of the disk previously occupied by the file is still not modified or overwritten and still contains all the file data, but that data is no longer linked to a filename. That spot of the disk is recorded as "free", however, so future writes to the disk can reuse that space, and if you keep using the disk the space will almost certainly be overwritten eventually.
Chosen Solution
Microsoft sets on files that you delete on the NTFS file system only one delete bit, but doesn't clear the data on the hard drive and also doesn't clear the MFT records and index data. Very small files (few hundred bytes) are stored entirely in the MFT and can thus always be recovered. Only when clusters that the deleted file occupies are reused to store other data then it isn't possible to recover a deleted file. On FAT32 (and FAT16) file systems this was more difficult, especially when a file is fragmented because on these file systems the bits that represent the cluster chain were cleared, so you had to be lucky that you could reconstruct the cluster chain. On NTFS is such a reconstruction not needed as you would only need to scan MFT. You would have to use a wipe utility on Windows to ensure that files with sensitive data are really gone and also do such a wipe if you would sell the computer.
Thanks for the answers folks, informative and useful. I did wonder when posing my question if all 'delete' did was uncouple the file from its links to folders, etc, thereby making the deleted file invisible. That sort of process would explain the claims to 'remove' deleted files, but I did not want to clutter my question with possible answers. The 'Wipe' facility is something I was unaware of. I will utilise it should my computer start to run out of space ! Once again, thanks for the answers.
The wipe utility is only needed if you want to make sure that the data is cleared from the hard drive as it takes considerable time to overwrite all the clusters that files that you delete occupy. If you run out of space on the hard drive then you can delete the files and either move them to the recycle bin or remove them directly.
Thanks for that, Cor-el. Should I need to use it, where is the 'Wipe' facility located ?
Forget that, I have checked and found various Apps, Eraser, CCleaner, etc.
Modified by LJones