This is a guest post series written by Elena Pakhomova, Marketing and Development for the data recovery software company www.ReclaiMe.com.
There are three articles to this series that examines the method(s) of deletion at the user-level, at the operating system level, and at the hardware level. Please visit again to capture the rest of the story…
In light of recent high profile espionage events, subject of personal data protection has become very popular. In this article I will try to shed light on the subject of data deletion and answer the question how does one delete the data so that even the FBI fails to restore it.
There are three parts involved in data management on every device, be it a PC, phone, or some other gadget.
User who creates content, manages it, and finally deletes it. – (SEE ARTICLE #1)
Operating system or more specifically a certain component of operating system called filesystem, which based on user commands stores, deletes, and performs other operations with data on the logical disk level. - (SEE ARTICLE #2)
Hardware – hard disk or other physical device which is responsible for storing data at the lowest level of electromagnetic fields and electric charge. – (SEE ARTICLE #3 – COMING SOON)
The behavior of each of the above parts determines how data is being deleted on a particular device and therefore what are the chances to restore it.
How A User Deletes Data
Not all people understand that the data recovery result depends on the way you delete the data. There are several ways to delete data; some of them are familiar to every user while the others are known to only a few.
This is the simplest type of deletion which is known to everyone both a PC user and user of some new-fangled gadget. In this case we just click “Delete” and believe that whatever we delete is gone. However, such deletion does not result in immediate and complete data deletion from a device. First, there is Recycle Bin from which you can often (though not always) restore files by several clicks. Second, when you delete data, even bypassing Recycle Bin, data is never deleted immediately. In this case, only information about the file is removed (its location on the disk, in which folder it was stored and so on). The file content itself is retained for some time making it possible to restore the file under certain circumstances.
This includes those cases when you intentionally want to delete your data in such a way that nobody can recover it.
Format is a quite common method to remove data, although not suitable for removal of individual files and folders. By formatting you can delete all the data stored on the device. Of course, the primary goal of the format procedure is to write blank data structures onto the disk before the first use, rather than to delete data irreversibly. Data deletion is a side effect of format.
Take into account that there are two types of format – quick and complete format. Quick format deletes only information about files rather than their content, while complete format removes data once and for all. Different operating systems and even different versions of the same operating system have different format type set by default. For example in Windows XP neither quick nor complete format deletes data irreversibly but in Windows 7 there is a crisp differentiation between these types of format.
Thus, it is clear that even format does not guarantee that data will be deleted irreversibly. So to be sure that you delete data irretrievably using a format procedure you should check what type of format your operating system uses.
Special erasing software
There are special tools (both free and paid) to erase files from a device irreversibly. Such tools just fill every sector on the device with zeros, so sometimes they are called zero-filling tools.
Among these tools, you should distinguish those which work with the entire disk like Lowvel and erase all the contents of the device and those which work file-by-file and delete a particular file or folder like
As for the tools working at the file level, it is difficult to ensure that all the parts of file are deleted. This is because the file system has a whole number of peculiarities in storing data.
So, only tools which erase all files can reliably ensure that data is completely deleted and nobody, not even FBI, can restore data after such tools have worked on the device.
It is quite exotic type of data deletion. The mechanism is similar to data deletion using special software, but in this case data is overwritten with another less valuable data rather than with zeros. Let’s suppose you have a 1TB disk with data you want to delete irreversibly. In this case you need to write exactly 1TB of another data (for example videos) to really overwrite all previous data.
Obviously, it is impossible to use this method if you need to delete a certain file or folder since for guaranteed deletion you have to fill all capacity of a device.
Mechanical disk damage
Surely, there is such an odd way to delete data as to damage the disk mechanically or, better yet, to melt it liquid. With mechanical damage you should be aware that any data recovery lab is able to replace various disk components. So, it is impossible to determine in advance whether data is recoverable based only an external appearance of a damaged disk, unless the disk looks like a pool of molten metal.
Thank You to Elena Pakhomova, Marketing and Development for the data recovery software company www.ReclaiMe.com for this GREAT ARTICLE!