Guide | How To "Why deleted files can be recovered and how you can prevent it"

The associated guide may contain user-generated or external content.

Venustus

Level 59
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Dec 30, 2012
4,809
hard-disk-head.jpg

When you a delete a file, it isn’t really erased – it continues existing on your hard drive, even after you empty it from the Recycle Bin. This allows you (and other people) to recover files you’ve deleted.

If you’re not careful, this will also allow other people to recover your confidential files, even if you think you’ve deleted them. This is a particularly important concern when you’re disposing of a computer or hard drive.

What Happens When You Delete a File
Windows (and other operating systems) keep track of where files are on a hard drive through “pointers.” Each file and folder on your hard disk has a pointer that tells Windows where the file’s data begins and ends.

When you delete a file, Windows removes the pointer and marks the sectors containing the file’s data as available. From the file system’s point of view, the file is no longer present on your hard drive and the sectors containing its data are considered free space.

However, until Windows actually writes new data over the sectors containing the contents of the file, the file is still recoverable. A file recovery program can scan a hard drive for these deleted files and restore them. If the file has been partially overwritten, the file recovery program can only recover part of the data.

Note that this doesn’t apply to solid-state drives (SSDs) – see below for why.

More
 

Venustus

Level 59
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Dec 30, 2012
4,809
Wow, CCleaner has a wipe feature!:) This is almost like discovering our car can change it's own oil! (well, maybe not quite as outrageous as that...):p:):)
Before I check, do Windows 7 or Windows 8 normally have have SSDs?:rolleyes:
Not normally,but the newer built systems especially "gaming systems" do come with SSD drives as standard equipment!

Check in your hardware properties and see what type of hardrive you are running!:)
 

Nico@FMA

Level 27
Verified
May 11, 2013
1,687
hard-disk-head.jpg

When you a delete a file, it isn’t really erased – it continues existing on your hard drive, even after you empty it from the Recycle Bin. This allows you (and other people) to recover files you’ve deleted.

If you’re not careful, this will also allow other people to recover your confidential files, even if you think you’ve deleted them. This is a particularly important concern when you’re disposing of a computer or hard drive.

What Happens When You Delete a File
Windows (and other operating systems) keep track of where files are on a hard drive through “pointers.” Each file and folder on your hard disk has a pointer that tells Windows where the file’s data begins and ends.

When you delete a file, Windows removes the pointer and marks the sectors containing the file’s data as available. From the file system’s point of view, the file is no longer present on your hard drive and the sectors containing its data are considered free space.

However, until Windows actually writes new data over the sectors containing the contents of the file, the file is still recoverable. A file recovery program can scan a hard drive for these deleted files and restore them. If the file has been partially overwritten, the file recovery program can only recover part of the data.

Note that this doesn’t apply to solid-state drives (SSDs) – see below for why.

More

Actually the newest generation of harddrives will NEVER forget which files you did have on your harddrive.
Maxtor, Seagate and Western Digital have specific tools available for law enforcement that can recover files up to over 100 reinstall events and partition wipes.
Which means that lets say for example: Some sick dude who likes to have VERY wrong pictures and VERY wrong video's on his computer, if he uses a harddrive cleaner (lowlevel) or a fresh install to get rid of evidence he can do that over a 100 times, and by doing so totally remove any trace of his sick online habits.
However forensic computer technicians can recover those files and the sick mofo is still going to jail for hopefully at least 100 years.
Personally i am not sure where the HDD would store these files, but i have been told that the latest generation of harddrives actually have a dual drive where very small file details are being stored, and a user cannot remove them regardless what he does.
Would that mean that every file is being stored? No but based upon specific file details the computer is capable of indexing the file and predict if the file meets "harmfull" or "illegal" criteria and thus is being flagged for long time storage.
Also MS indexing service is indexing files on your PC and sends data strings to MS which also has the ability to keep certain files in micro storage.
And this is one of many ways why a internet asshole always gets caught.

Cheers
 
Last edited:

Venustus

Level 59
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Dec 30, 2012
4,809
Actually the newest generation of harddrives will NEVER forget which files you did have on your harddrive.
Maxtor, Seagate and Western Digital have specific tools available for law enforcement that can recover files up to over 100 reinstall events and partition wipes.
Which means that lets say for example: Some sick dude who likes to have VERY wrong pictures and VERY wrong video's on his computer, if he uses a harddrive cleaner or a fresh install to get rid of evidence could reinstall is computer from scratch over a 100 times, and by doing so totally remove any trace of his sick online habits.
However forensic computer technicians can recover those files and the sick mofo is still going to jail for hopefully at least 100 years.
Personally i am not sure where the HDD would store these files, but i have been told that the latest generation of harddrives actually have a dual drive where very small file details are being stored, and a user cannot remove them regardless what he does.
Would that mean that every file is being stored? No but based upon specific file details the computer is capable of indexing the file and predict if the file meets "harmfull" or "illegal" criteria and thus is being flagged for long time storage.
Also MS indexing service is indexing files on your PC and sends data strings to MS which also has the ability to keep certain files in micro storage.
And this is one of many ways why a internet asshole always gets caught.

Cheers
I agree with what you say and there is "forensic software" that can recover files with relative ease,as has been proven in countless court cases around the world
This was only meant as a guide for the lay person and not the criminally motivated one,eg child porn etc
Thanks!!:)
 

Nico@FMA

Level 27
Verified
May 11, 2013
1,687
I agree with what you say and there is "forensic software" that can recover files with relative ease,as has been proven in countless court cases around the world
This was only meant as a guide for the lay person and not the criminally motivated one,eg child porn etc
Thanks!!:)

I know and its a good article, but to make the story complete i added the missing part.
Just helping out.
 

nissimezra

Level 25
Verified
Apr 3, 2014
1,460
Actually the newest generation of harddrives will NEVER forget which files you did have on your harddrive.
Maxtor, Seagate and Western Digital have specific tools available for law enforcement that can recover files up to over 100 reinstall events and partition wipes.
Which means that lets say for example: Some sick dude who likes to have VERY wrong pictures and VERY wrong video's on his computer, if he uses a harddrive cleaner (lowlevel) or a fresh install to get rid of evidence he can do that over a 100 times, and by doing so totally remove any trace of his sick online habits.
However forensic computer technicians can recover those files and the sick mofo is still going to jail for hopefully at least 100 years.
Personally i am not sure where the HDD would store these files, but i have been told that the latest generation of harddrives actually have a dual drive where very small file details are being stored, and a user cannot remove them regardless what he does.
Would that mean that every file is being stored? No but based upon specific file details the computer is capable of indexing the file and predict if the file meets "harmfull" or "illegal" criteria and thus is being flagged for long time storage.
Also MS indexing service is indexing files on your PC and sends data strings to MS which also has the ability to keep certain files in micro storage.
And this is one of many ways why a internet asshole always gets caught.

Cheers
Thats why I disable almost all the tasks in win 7

thnx for info
 
  • Like
Reactions: Venustus

Banzee Simmons

New Member
May 14, 2014
1
It can converted into a nice blog than just posting it on forum. You have provided really useful information that cannot be easily found on internet.. All they do is promote their own product, and no one cares about the actual problem of users..
 

MrXidus

Super Moderator (Leave of absence)
Apr 17, 2011
2,503
Actually the newest generation of harddrives will NEVER forget which files you did have on your harddrive.
Maxtor, Seagate and Western Digital have specific tools available for law enforcement that can recover files up to over 100 reinstall events and partition wipes.
Which means that lets say for example: Some sick dude who likes to have VERY wrong pictures and VERY wrong video's on his computer, if he uses a harddrive cleaner (lowlevel) or a fresh install to get rid of evidence he can do that over a 100 times, and by doing so totally remove any trace of his sick online habits.
However forensic computer technicians can recover those files and the sick mofo is still going to jail for hopefully at least 100 years.
Personally i am not sure where the HDD would store these files, but i have been told that the latest generation of harddrives actually have a dual drive where very small file details are being stored, and a user cannot remove them regardless what he does.
Would that mean that every file is being stored? No but based upon specific file details the computer is capable of indexing the file and predict if the file meets "harmfull" or "illegal" criteria and thus is being flagged for long time storage.
Also MS indexing service is indexing files on your PC and sends data strings to MS which also has the ability to keep certain files in micro storage.
And this is one of many ways why a internet asshole always gets caught.

Cheers

Citations for the text I've colored please. Interested, thanks.
 
  • Like
Reactions: Littlebits

Nico@FMA

Level 27
Verified
May 11, 2013
1,687
Citations for the text I've colored please. Interested, thanks.

You mean proof? Uhhhmm you might wanna see http://en.wikipedia.org/wiki/List_of_data_recovery_software
Every major HDD manufacturer has submitted source data to access their modules within the HDD.
But i only know about Maxtor, Seagate and Western Digital as i have seen it with my own eyes at my job.
Also you might hit Google there you can read countless newspaper topic's how police, FBI and forensic specialists retrieve deleted data from computers and harddrives.
 

MrXidus

Super Moderator (Leave of absence)
Apr 17, 2011
2,503
Red text covered, now can you also provide sources for the orange and blue text I've colored in a quote.

Cheers.
 

Nico@FMA

Level 27
Verified
May 11, 2013
1,687
  • We offer expert testimony and expert witnesses to verify data recovery efforts, findings and methods that will stand up in any court.
  • Our Litigation Support Services will recover/organize all pertinent data that will assist you in Services cover all areas of computer fraud, misuse, internet/e-mail abuse, pornography and hacking among others.
  • Our laboratory uses the most up to date computer forensics technology. Our experts are able to locate evidence on almost all storage media.
http://www.legalforensics.com/
http://www.cnet.com/news/nsa-reportedly-planted-spyware-on-electronics-equipment/

Other then this in cannot come up with something better, as theirs is just not much written about it,
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top