Helping people with computers... one answer at a time.

A technician certainly could stumble across this. But if they're looking at deleted files and that's not part of what they're trying to recover? To me, that's unethical.

Could a technician servicing a computer for viruses see deleted browsing history from seven years ago? I know there are ways to detect old history but this is from a long time ago and I would think that the hard drive space has been overwritten. If it is possible to see the history, how likely is it that the technician would be looking at that to fix the problem?

In this excerpt from Answercast #62, I look at the possibilities of technicians finding old information on a computer while they are attempting to repair it.

Recovering history

Let's see. First, let's start with the seven years part. It's really unlikely, but I have to say it is possible.

The way that files are laid out on disk... Well, it's kind-of, sort-of random, but the operating system tries to keep them really close together.

So, here's a scenario that could result in history from seven years ago still being available (at least on the hard disk) today:

  • You have a very full hard disk.

  • You do some browsing that creates some history. We'll think of it as history that's say out on the edge of your hard disk space.

  • Now, you delete something on your hard disk that's really big, so your hard disk now has a lot of free space.

  • And while you're at it, you delete that history, so that file that contained the history is now a deleted file.

We all know that means the file data is still on the hard drive, but the sectors that it is contained in are marked as "available for use." Like I said, we've deleted a bunch of information from the hard drive, so it has a bunch more free space.

In the subsequent seven years, that drive never, ever gets that full again. You end up using it, you end up deleting files, whatever. But the fact is that the disk never gets so full that it actually overwrites those history sectors, those sectors containing your history from seven years ago. It's possible.

I don't think it's very common. I think that by and large there are a number of factors that play into this that effectively will cause most sectors to be overwritten eventually. But the fact remains, we have to say that it is theoretically possible.

We really don't know exactly how likely it is because there are so many factors at play here. The most important one of course being how much you use your hard disk.

Secure delete

The only way to make that go away is to before you hand your machine over to a technician, run a secure delete program that will delete or overwrite all of the free space. That makes this kind of thing a non-issue.

That overwrites the data that was contained in those seven-year-old files because those files were deleted, but the sectors still have the data. A free space wipe actually goes through and overwrites all of the unused space on your hard drive, so that there's nothing that can be found anymore.

Nosy technicians

Now, how likely is it that a technician would find this stuff? Well, it really depends on what the technician is doing.

They could be needing to look at deleted files in order to repair whatever it is they're repairing. They certainly could stumble across whatever this file contains.

How likely is it that they are going to be specifically looking? Gosh, I hope not very likely!

I mean, a technician should be sticking to his job. Hopefully, a technician (a good technician) is going to be busy enough that he's going to be in, fix the problem, and out. He's not going to go spelunking on your hard drive for things that he shouldn't really be looking for.

On the other hand, we do hear it about from time to time. There are technicians that discover all sorts of random things on hard drives, whether that be because they're actively looking (especially if they're actively looking) at deleted files.

That's a pretty nosy technician, if you ask me. If they're looking at deleted files and that's not part of whatever it is they're trying to recover, that to me is unethical and not a technician that I would want to use. On the other hand, like I said, they could stumble across it. It is possible.

Article C5932 - October 18, 2012 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

4 Comments
GREG JACKSON
October 19, 2012 4:47 PM

In a way, this prompts a question about best practices before handing a PC to a technician. More so, a first time need to use a technician for needed service, and not really knowing anything about this person or their ethics. Man, that's trust - but what else can a person do?

Gwyn
October 24, 2012 8:30 AM

Could you please explain a bit more about how you would go about doing a "Secure Delete"? I assume it's diferent from the DBAN program I've read about on here from time to time.

connie
October 24, 2012 5:09 PM

@Gwyn,
Here's a good article on secure delete.

Gwyn
October 25, 2012 4:16 AM

@connie : Thank you connie. Come to think of it I should have done a search on here before posting !

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.