Where Does Deleted Data Go? Unveiling the Secrets of File Deletion and Overwriting

Ever wondered where the files go when you delete them from your computer or phone? Are they really gone or are they just playing an epic game of hide and seek behind those memory blocks, waiting to be recovered? I’ve got a burning curiosity and an urge to understand what actually happens at the lowest level when we delete a file. So, let’s embark on this journey of discovery… and hopefully, we’ll find out that the files aren’t just off on a tropical vacation!

collected from vecteezy

To understand what happens when a file is deleted and overwritten, and how the storage system handles data at a deeper level, we need to break down how files are stored and managed on a storage device. We’ll also dive into the physical aspects of how bits and bytes are written, erased, and overwritten, and explain why they don’t “pile up” or continue to occupy space after being overwritten.

1. How Data is Stored: Understanding Bits and Bytes

At the lowest level, all files whether they’re text, images, or programs — are stored as sequences of bits (0s and 1s). These bits are grouped into bytes (8 bits make 1 byte). Bytes represent the actual data, and they are stored in blocks on a storage device.

• Blocks: Storage devices, whether hard drives (HDDs) or solid-state drives (SSDs) are divided into chunks called blocks. Typically, each block is 4KB (4,096 bytes), and a file can occupy multiple blocks.
• Data Mapping: The file system keeps a record of where each file’s blocks are located. When a file is saved, it writes data to specific blocks, and when it’s deleted, the system marks those blocks as available.

2. What Happens When You Delete a File?

When you delete a file, the following happens at a low level:

• File table update: The file system (like NTFS, FAT, etc.) removes the file’s entry from its index (file table). This index entry is what the operating system uses to find and access the file, so removing it makes the file “invisible” to the system, but the file’s actual data still resides in the blocks on the storage device.
• Blocks are marked as free: The storage blocks that contained the file’s data are marked as free, meaning they can be reused for new data, but the old data is still physically present on the storage device until it is overwritten by new data.

3. What Happens During Overwriting?

When new data is written to the blocks that were previously occupied by the deleted file, this is called overwriting. Here’s what happens at a deeper level:

Hard Disk Drives (HDDs):

HDDs store data magnetically on spinning disks called platters:

• Writing data: When you save data to an HDD, the drive head changes the magnetic orientation of the material on the platter to represent 0s and 1s. These magnetic orientations store the bits.
• Deleting a file: When you delete a file, the file system only removes the reference to the data in the file table and marks the area as free. The magnetic patterns representing the data are still there.
• Overwriting data: When new data is written to the same area, the magnetic orientations of the platter are changed to reflect the new data (0s and 1s of the new file). The old data is effectively “erased” because the magnetic state has been rewritten. There is no trace of the old data once this occurs.

Solid-State Drives (SSDs):

SSDs store data electronically in memory cells that hold charges:

• Writing data: In an SSD, data is stored in flash memory cells. Each cell can hold a certain amount of charge, which represents a bit (0 or 1). When data is written, the SSD changes the charge in these cells to represent the bits of the data.
• TRIM command: When a file is deleted on an SSD, the operating system typically sends a TRIM command to the SSD. This tells the drive which blocks are no longer in use and can be erased in the background, preparing them for new data. This makes SSDs more efficient, as it allows them to write new data faster without having to first erase old data.
• Overwriting data: When new data is written, the cells holding the old data are erased (in SSDs, this is done in chunks called pages or blocks). The new data is written by changing the charges in the cells. Once this happens, the previous data is gone.

4. Does the Old Data “Pile Up” When Overwritten?

No, old data does not “pile up” under the new data. Here’s why:

• Data on an HDD: When new data is written to the same area as the old data, the magnetic field that represents the old bits is physically altered to represent the new bits. The old magnetic state is lost. There’s no layering or piling up — there’s only the new magnetic orientation that represents the new data.
• Data on an SSD: In an SSD, once the memory cells are overwritten, the old electrical charge that represents the old data is changed to a new charge, representing the new data. The memory cells physically store only one set of data at a time (either the old or the new, but not both).

5. What Happens to the “Space” When Data is Deleted?

When you delete a file, the storage device doesn’t immediately free up space by removing the actual data from the drive. Instead, it simply marks the space as available for future use. Here’s how space is managed:

• File system marking: After a file is deleted, the storage blocks used by that file are still occupied by the file’s data, but the system marks them as available for future writing. They don’t take up additional space because they are already part of the physical storage.
• No extra space used after overwriting: When new data is written to those blocks, the old data is overwritten. The new data simply replaces the old data in the same physical space on the disk, so the space isn’t consumed twice — it’s only used once, for the new data.

6. Why Secure Deletion is Needed for Sensitive Data

Even though normal deletion doesn’t immediately remove data, it’s important to use secure deletion methods if you want to ensure the data cannot be recovered. These methods include:

• Overwriting: Tools that securely delete data will overwrite the blocks multiple times with random data (0s and 1s), ensuring that even sophisticated recovery techniques cannot reconstruct the original data.
• SSD Secure Erase: SSDs have specific commands (like Secure Erase) that ensure all blocks are completely erased, making it impossible to recover data.

7. Physical Limits of Data Recovery

• On HDDs: In theory, even after overwriting, slight residual magnetic traces of previous data might remain, which is why advanced forensic techniques (like magnetic force microscopy) can sometimes recover bits of overwritten data. However, modern secure deletion methods make this extremely difficult.
• On SSDs: Once data is overwritten or erased with TRIM, it’s nearly impossible to recover because flash memory doesn’t leave behind any residual traces like magnetic media.

Summary

• When you delete a file, the file system marks the space as free, but the data remains on the storage device until overwritten.
• Overwriting changes the physical or electrical state of the bits in storage. The old data is not layered under the new data; instead, it is completely replaced.
• The old data doesn’t take up additional space — once overwritten, only the new data exists in that space.
• HDDs and SSDs handle deletion and overwriting differently due to their physical properties, but in both cases, once data is overwritten, it’s effectively erased from the storage.

For sensitive data, secure deletion tools ensure the old data is completely and irreversibly overwritten, making it impossible to recover.

I wrote this entire blog with my own research and used ChatGPT to help structure it. Please let me know if there are any misunderstandings.