A deleted file… still exists?

Let's take a look at this very common scene:

⚠️ Of course, since depictions of computer science in fiction are often crap... mediocre, to put it politely, you can legitimately suspect that this is a scriptwriting device similar to infinite zooms:

In the case of deleted files, the question arises:

💡 Is it possible to recover deleted data, and if so, by what miracle (given that it is supposed to have been deleted, precisely)?

That being said, let's now talk about a file that is really deleted, once the recycle bin has been emptied.

▶️ We often have a misconception about how a file is stored: we tend to imagine that the medium (hard drive, SD card, etc.) is a blank page that we fill or erase.

⚠️ Except that's not really how it works. A medium will contain a certain number of bits that can be zero or one: there is no “blank” or “unused” state. Your digital medium is never a blank page, but rather a long series of switches that can be open or closed:

▶️ When you store a file, nothing is actually “written”: you have to imagine that these switches are then arranged to accurately represent the file's content, a bit like when you enter a code by turning the wheels on a combination lock.

💡 So how do we know that a location on the disk is occupied by a file and not by a meaningless string of bits? Well, the file system keeps track of where each file is located and how much space it takes up, in a kind of small address book.

💡 So what happens when you delete a file? Well, you simply delete the reference to that file in the address book.

▶️ That's why the file can still be recovered with the right tools: even though it is no longer referenced by the system, its content is still on the disk!

✷ A slightly more technical story than this comic, which I told on the game's blog.

⚠️ Obviously, since the area previously occupied by the file is now considered free by the system, it will potentially be used to store something else in the future, and the content is likely to be overwritten —and therefore truly deleted— soon.

⚠️ Conversely, the fact that files are not actually deleted can be a real security issue!

💡 Obviously, you have to gauge your level of paranoia based on the use case and the threat level.

✷ An encrypted hard drive requires a secret key to be read: so even if you recover the bytes written, without the key, you won't be able to do anything with them.

So you might ask me:

But why doesn't the system actually delete the file?

By filling the memory space with zeros, for example?

💡 Note that if you really want to physically erase the content of a file, there are utilities designed for that purpose: on Gnunux, for example, it's the shred command.

✷ Forensic techniques could be used to recover data that has been overwritten just once on certain media, so you can never be too careful.

Personally, if I had to pass on a personal digital medium to someone, I'd make sure to run the shred command on the entire medium involved.

⚠️ But the worst part is that even that wouldn't completely guarantee erasure: in fact, some sectors that have become invalid on a hard drive may never be rewritten...

In conclusion, what we call “deleting a file” can have many meanings, and it's important to understand what we're talking about: