Imagine you’re standing in your dusty garage. It’s completely empty aside from you and ten cardboard boxes lined up in a row on the concrete floor in front of you. In each of these boxes are your personal documents, organized in chronological order. The boxes are closed, so how do you know what is in each box?
You look closer at the sides of the boxes and notice that each one is numbered: 1, 2, 3, 4, 5, and so on. “Okay,” you think aloud, “but where is the TPS report I’m supposed to have? Lumberg needs it by this afternoon.”
You could start at the beginning of the boxes and look through them for the document you’re looking for, but that would take far too long. Instead, you remember that you are holding a clipboard. On that clipboard is a piece of paper, and on that piece of paper is a list of every document in the boxes. You slide your finger down the list, looking for “TPS report” and see that it is the third document in Box 6.
Computers store their files in a very similar way. Every bit (bits are what your files are made of at the lowest level) has its own address it can be found at on the hard drive. When a user wants to open a file, for example TPSReport.txt, the computer looks up on its own metaphorical clipboard where the file is located (just like how you did on your own clipboard ten seconds ago) and basically jumps directly to that place in memory to load the file. So when you double click TPSReport.txt on your desktop, the computer opens up notepad and loads in whatever is stored in the hard drive’s equivalent to Box 6: Document 3.
However, there are actions on the user’s end that don’t penetrate deep into the computer’s inner workings. One of these actions is deleting files. Your computer has a clipboard of where every file is, just like you did in your garage. When you move something to the recycle bin on Windows, it removes the entry on the clipboard that says “Desktop/TPSReport.txt is the third document in Box 6″ and adds another row at the bottom saying something like, “Recycle Bin/TPSReport.txt is the third document in Box 6.” This way, people can recover documents from their recycle bin that they didn’t mean to delete.
But any avid Windows user knows that holding down shift and pressing delete on a file brings up a dialog box asking if you’re sure you want to “permanently delete” that file. If you click OK, the file poofs — never to be seen again.
That is, unless someone looks for it.
Computers (and Windows in particular, when it says it is permanently deleting a file) are a bit misleading. When you “delete” a file, what is actually happening is this: the computer removes the row on the clipboard that says where that file is stored. If an icon stayed on your desktop somehow and you double-clicked it, the computer wouldn’t have a row that says where the file is, so it couldn’t open it.
So for the most part it is “deleted.” You can’t open it, and someone getting on your computer can’t open it.
Except the file is still in Box 6. In fact, it’s still the third document in Box 6. There’s just no row on your clipboard to tell you that. If you knew–maybe from your brilliant memory of a minute ago–you could go back and grab it directly out of the box, as long as you knew where to look for it. The same goes with computers.
Lets not forget the original option that you thought about doing when you wanted to find the file. You could have started at the first box, ignoring your clipboard, and looked through each box until you found the one you were looking for. It’d be slow, but you’d be guaranteed to find it if it were stored in one of the boxes.
The same concept applies here, and that’s how a lot of our new-age computer forensics tools work. When the government, police, or even just a hobby techie, gets ahold of your computer, a simple tool can retrieve all of your files–even the ones you’ve deleted. This type of tool catches hackers, pedophiles, warez distributors, and basically anyone suspected of unlawful activity on a computer.
Now, you may be asking: so how do I actually delete my files?
The truth is, unless you’re paranoid enough to want them deleted immediately, they will delete themselves over time. As you create more files, edit old files, use programs, or even turn on your computer, more space is needed by the computer to save stuff. When a computer needs more space to store stuff, it looks at its clipboard and finds space that isn’t currently being used. It’s basically random whether it picks a space that is where your “deleted” file is hiding, or whether it picks other spaces. To truly delete your files, you just need your computer to write over them with new data. So basically, your computer has to take out documents in Box 6 to make room for new documents (they’re placed in the same place, but they’re different. Once they’re out of the box, they’re gone for good in the computer’s eyes. After all, the computer wouldn’t look at the rest of your garage, it’d only look at what is inside the boxes.)
If you’re extremely paranoid or working in a setting where you need to make sure your files aren’t recoverable, the Department of Defense has created the DoD 5220.22-M standard for ensuring complete erasure of a file. It states that writing over a file 35 times with specific values (zeros the first time, ones the second time, random digits the third time, and so on) will render a file (or a whole hard drive, depending on what you’re trying to do) completely unrecoverable by any means. The popular program, Derik’s Book & Nuke (DBAN) automates this process.
In conclusion, “deleting” a file doesn’t actually delete it. Instead, it solely makes the computer forget where it is stored in memory and allows the space to be used for other files or purposes. Until the space has been overwritten, the file is completely recoverable with the right tools and a sexy geek behind the keyboard.