How to remove files safely from an HDD or SSD in Windows 10

You select a file and press Delete, and it disappears. But what actually happens to the file? Does it vanish or get erased from the disk permanently? If you are an advanced Windows user, you know for sure it’s quite the contrary.

There are several reasons why it’s worth considering this issue. The first one is that even when a file is removed accidentally from the computer or it is lost after a virus attack, you should know that there are high chances to recover it. The second reason is that if you can recover any deleted file on your won, then any other user who can get access to your PC will be able to do the same — which might be a serious problem.

What happens when you delete a file?

In case of conventional hard disks (HDD)

When a file is deleted, it is sent to the Recycle Bin, that is, when you press the button Delete on your keyboard, the file is just marked as deleted and the shortcut to such file appears in the Recycle Bin directory. By default, the Recycle Bin is enabled when you install any version of Windows, and it is enabled for every local disk connected to your PC. To disable the Recycle Bin, right-click on its desktop shortcut and select Properties. Choose each disk on the list and check the option Don’t move files to the Recycle Bin. Remove files immediately when deleted, then click Apply.

Recycle Bin is a very useful integrated feature in Windows. It allows you to restore deleted files and folders if you removed them by accident or if you need them some time after deleting. But what happens when you empty the Recycle Bin, that is, delete files permanently? In fact, nothing happens — nothing at all! The files are neither deleted from the disk nor moved elsewhere. The only thing that happens is updating a certain file in the operating system which says that the disk space allocated for the deleted files is now marked as free and any information can be written there — and overwrite the old data.

This file used by conventional hard disks is known as Master File Table (MFT), and looks like this.

The first column on the left displays blocks of addresses. The middle column shows data in the hexadecimal code (also known as HEX). The column on the right presents the way this data looks as simple text.

Therefore, the deleted file will be stored in the hard disk until the operating system overwrites this area with new data. The time required for this to happen can be quite long — up to a few months, but basically, it depends on the total size of your hard disk, on how you use your computer, and on what kind of local disk the old data is stored in. Data in the system disk (by default, it’s С:\) can be overwritten very soon, even within several minutes, As Windows writes new temporary data to disk all the time: system cache, program cache, web cache and so on.

Let’s illustrate it with the example: we’ll use an app called NTFSWalker to scan any NTFS partition on a hard disk. The left column displays the list of files the app could find on the disk. The red letter X marks the MFT addresses which have been overwritten completely or partially, and the lines without such letter represent the addresses that have not been overwritten yet. In the right column, you can see additional information, including what specific data is written at this address. Now the problem of deleting files in an ordinary way becomes more obvious.

In case of solid-state drives (SSD)

Things are a bit different for SSDs. As solid-state drives are different from conventional HDDS in terms of technology, SSDs always write and move written data according to a special scheme so all physical memory of the storage device is used uniformly and proportionally. This standard feature allows to extend the SSD lifespan considerably by suggesting rational use of the read/write cycles — the guaranteed number of which is limited. This way, all memory blocks will be worn out evenly, and the risk of separate blocks to get out of order is reduced.

Therefore, if you delete a file with the address 2871 (for example), the deleted data may be relocated to another area on the disk sooner or later, until the SSD’s electronic brain decides to overwrite it. So how can you overwrite the unnecessary files for sure? In fact, it’s next to impossible to erase a specific file completely on an SSD. A group of engineers at the University of California, San Diego studied this topic and witnessed first-hand that completely erasing data from an SSD is very difficult. In an attempt to erase one file reliably, the disk actually retained from 4% to 75% of the file’s internal data. So my advice is to make sure you have encrypted your SSD and find out if your disk supports the TRIM feature.

Actually, this problem is not too relevant for most users, but at the same time, you might be worried that hackers may get their hand on the data deleted from your disk. It’s quite possible you deal with secret or sensitive data, documents containing trade secrets, or just store your personal banking data openly. So how could you remove this information reliably so that it doesn’t fall into the wrong hands?

Is that safe?

Before learning how to safely erase data from an SSD, let’s find out what exactly it means to you. That is, if you are satisfied with the current level of safety, it is going to be safe. If the data you don’t want to be restored is not of vital importance and can’t be used against you, then delete it in the standard way and don’t worry. Yet if you remove some banking data, work documents or data required for online authentication, it’s preferable to remove such files in a way that makes their recovery without your knowledge impossible.

Now let’s have a closer look at some methods of safe — and not too safe — file removal in Windows. Until we have reached the part for full removal / full erase of the entire disk space, these methods only apply to conventional HDDs.

The most dangerous method

The easiest and most dangerous method of removing files is to select a specific file or files and press Delete on the keyboard. It will send the file to the Recycle Bin, right-click on the Recycle Bin shortcut, and select Empty Recycle Bin from the context menu. As I said before, the disk area occupied by this file will be marked as empty and ready for new data, but the actual contents of the file are still there on the disk and it can be restored easily. With this method, you can get rid of all types of files that are of no value to you: system cache, browser cache, unnecessary apps and updates, temporary files and so on.

For example, you want to delete several photos. Go to the corresponding directory, select the files and remove them.

Then download from the official website hetmanrecovery.com a free trial version of the easiest data recovery program, Hetman Uneraser. Install it and scan the required disk — in my case, that is disk D:\.

In the window that opens, browse for the folder — in my case, its name is Test. Here you are! You can see the list of deleted photos, and click on each one for preview. The only thing left to do is to select the files and click Recovery, then save them to a different storage device.

Somewhat dangerous method (for conventional HDDs only)

As I said earlier in this article, physically overwriting data with some other information is quite a good method of truly removing old files. This can be done with specialized software that will reliably overwrite the disk space occupied by a file with some random data. When trying to use a data recovery tool, hackers will be able to view the file name but its contents will be lost forever. This way, you can remove both separate files and entire directories.

Such utilities may look very different, but they employ the same procedure — delete the old file and overwrite its location with zeroes or random values. Software tools of this kind can guarantee a higher degree of safety if compared with the standard removal scheme. The only problem is you have to always use such tools when removing important files. Yet too often, users forget about it and remove important information in an ordinary way.

For example, I moved several photos to a folder named Test2 and now I’d like to remove them permanently. I need to download a specialized program, for example, Mareew Free Erazer. Install and launch it, find the required directory on the left and select the file to remove. Click Delete File.

Now use a data recovery tool to check if the file contents have been removed. As you can see, the tool shows the file name and that the file was deleted. When selecting it for preview, all you can see is a JPG-type icon, and the actual photo is not shown.

Erase free disk space (for conventional HDDs only)

The more acceptable and quicker way to erase the files completely after you deleted them with the Recycle Bin is to use ready-made software solution like CCleaner. This PC optimization tool is based on the all-in-one principle. With CCleaner, you can remove temporary and Internet files from the system disk, clean the system cache and program cache, clean the Windows registry, uninstall unneeded programs, and update the ones you’d like to keep. This app is one of the world’s best popular utilities — over 2.5 billion installations!

CCleaner features a very useful function — erasing the free disk space physically (Wipe Free Space) which we will focus on. Visit the website www.ccleaner.com and download the free version, then install it to the system disk. Right-click on the desktop shortcut and choose Properties. Switch to the Compatibility tab and check the box Run this program as an administrator. This step is important to enable CCleaner to access all Windows directories, including system folders.

Click Apply and ОК. Launch the program, click Tools on the left and choose Drive Wiper. When the new tab opens, find Wipe and select Free Space Only, which means you are going to erase deleted information in all of the free disk space. In the field Security select Simple Overwrite (1 pass), which means the program will make one pass to erase the data. In this filed, you can select up to 35 passes to erase the information entirely, but for me, it seems too much. Select the local disk to work on or a group of disks, check the boxes and click Wipe, and all disk space marked as free will be overwritten with zeroes.

This method is more convenient as it erases all deleted files and folders at once so you don’t need to hunt each one down. The downside, though, is that erasing takes much longer and has to be run regularly — and do you know many users who would clean the disk space every day?

Now let’s test how good this method is when we use Hetman Uneraser after that. For example, I created a folder named Test3 on disk D:\, copied several important photos there, then deleted them and wiped free disk space with CCleaner.

Now let’s start Hetman Uneraser, run a quick scan on disk D:\ and switch to directory with the name Test3. As a result, the program can’t find any of the deleted files. It is fair to say, though, that wiping free disk space took over 50 minutes. The time required for this operation depends largely on the capacity of the local disk and on how actively it is used.

The safest methods (for both HDD and SSD)

The safest solutions to such problem are based on the principle of removing all contents from storage devices. However, you can’t apply the same method to all drive types, as SSDs differ from HDDs in terms of their design and technology. Below, I will list several options, and you can choose the one that fits your disk type.

These methods will be useful when you decide to sell your old PC or send it to a scrap yard. To make sure nobody can recover data from your disks, it should be removed. Also, when you buy a new PC or reinstall the operating system, you should create local disks anew. These methods will also be useful if there are disk errors: if that’s the case, you will have to remove all partitions, remap the disk again and format the entire disk space.

Disk formatting

To format a disk means to remove all of its data together with any viruses, unwanted programs and errors. There are two types of formatting: quick and full (low-level).

Quick format wipes only the so-called MFT (MBR) area, but the actual FAT structure of the disk remains intact, while Windows sees such disk as absolutely empty. Restoring data after formatting is too difficult a task for Hetman Uneraser; it takes a more powerful tool capable of low-level data reading, such as Hetman Partition Recovery. You can download it from the official website hetmanrecovery.com.

Let’s suppose you want to format a local disk. To do it, go to This PC, right-click on the necessary disk icon and select Format. In the window that appears, make sure that the proper file system is selected and the box is checked for Quick format, then click Start. In a few minutes (the actual time depends on the disk size), formatting operations will be over and the disk will become empty.

Let’s check the result with Hetman Partition Recovery. To begin with, download the program, install and launch it: the wizard starts automatic scan for all connected storage devices. Double-click on the local or physical disk to start the File Recovery Wizard. In the first stage, choose Full analysis and click Next. It will start the search for all information available on the disk.

I’d like to note that full low-level scan may take quite a long time depending on the disk capacity and disk errors, both logical and physical. After the scan, the program will display all files and folders it was able to find, with the folder structure retained. After that, just select the files you need, preview them and click Recovery.

As can be seen from the screenshot, recovering data after a quick format takes no effort for Hetman Partition Recovery.

The second scenario involves full (low-level) formatting. In fact, this is the real formatting able to destroy all information on the disk, rebuild the FAT structure and overwrite all data with zeroes. Yet beginning with Windows 8, you can’t run full format with tools integrated into the operating system. To do it, you will have to use third-party apps which are aplenty on the Internet, both free and commercial, for example, Darik Boot and Nuke.

Special utilities to format SSDs

Most SSD manufacturers develop their own utilities to manage and safely remove data from their disks. Usually, these utilities can be downloaded for free in the Support section of a website.

For example, Kingston SSD Manager — a utility from the disk manufacturer that provides full control and monitoring of all settings in SSDs by Kingston. It helps users follow all kinds of disk issues, monitor the health values, see full model name and serial number, update the disk firmware automatically, and run safe removal of its data.

The Security tab contains a feature for safe removal or erasing of all disk data, but it is only active when the SSD is not used as a system drive.

The toughest way to remove (for both HDD and SSD drives)

At the moment, there is a method developed to destroy the most important data. Actually, it is the most aggressive way to treat data, as it leaves no pieces of information behind.

It is based on melting the physical storage device, and There is a special NIST standard developed for this particular method. Specially licensed machines are designed to heat the disks to utmost temperatures, which turns them into pieces of scrap metal, and obviously very sensitive information (like secrets of state) does require such ironclad-guarantee methods.