Helping people with computers... one answer at a time.

Deleted files might be easily recovered unless you take additional steps to ensure that they're not. I'll look at why and what to do.

If I have deleted documents/photos from my PC and the Recycle Bin, is there a way that people can still find them? Or have I deleted them completely from my PC/hard drive?

It is possible that the files could still be recovered.

It's also possible that they could not.

There are additional steps that you should take if you want to ensure that a deleted file actually is and stays deleted.

Deletion, deletion and deletion

There are actually three ways that files can be deleted. Each has a different chance of being recovered.

“What you need depends on your level of paranoia and the sensitivity of the data that you are deleting.”
  • Moving to the Recycle Bin. When you delete a file in Windows Explorer or in some other applications, the file is not actually deleted at all, but rather simply moved to the Recycle Bin.

  • Permanent delete. When you empty the Recycle Bin or delete a file in the Windows command prompt, or when most programs delete a file, the file is just removed from the list of files on the system. The area that the file's data previously occupied is marked as unused, but it is not otherwise erased.

  • Secure delete. Secure delete operates like permanent delete but it takes the extra step of overwriting the area previously occupied by the file's data. Because of this, secure delete is often more time-consuming. Secure delete also typically requires additional tools that are not part of Windows.

In common usage, file deletion is usually one of the first two: moving files to the Recycle Bin or some kind of permanent delete.

Recovery, recovery and recovery

Each of the three methods of deleting files have a corresponding approach to recovering what's been deleted. Some are easy, some are exceptionally difficult, and some require special tools, luck, and timing.

  • Files that have been deleted by being moved to the Recycle Bin can be undeleted simply by moving them back. As you might imagine, that's exactly why the Recycle Bin exists. People were accidentally deleting files that they didn't mean to and the Recycle Bin acts as a safety net.

  • Files that have been permanently deleted can sometimes be recovered by using undelete or recovery utilities. Because a so-called "permanent" delete doesn't actually overwrite the file's data, it is possible for software tools to rediscover or reconstruct the file from what's been left behind. This type of recovery requires both luck and timing as the data previously occupied by the deleted file is marked as available free space on disk. That means that files subsequently written to the disk could cause the deleted file's data to actually be overwritten. As Windows is constantly writing to the hard disk, the sooner that a recovery is attempted, then the higher are the chances of its complete success. It's not uncommon for me to recommend the program Recuva, which is one of many programs that perform this type of file recovery.

  • Files that have been securely deleted can typically not be recovered. There can be exceptions, though. For example if the secure delete overwrites the data only once, there are advanced (and expensive) data recovery techniques that can use the residual magnetic field of previously stored data to attempt to recover it. That sounds complex because it is; as I said, it's both difficult and pricey.

What do you need?

What you need depends on your level of paranoia and the sensitivity of the data that you are deleting.

For most average users, the combination of the Recycle Bin and permanent delete is almost always sufficient. Couple that with making sure to fully erase the hard drive with a tool such as dban before discarding the machine and you have the vast majority of concerns covered.

If you have legitimate concerns, or are just feeling paranoid, a reasonable approach is to run a secure delete utility periodically to wipe the free space on your hard drive. This ensures that deleted files which have not yet been overwritten by other files cannot easily be recovered.

And finally, one approach that completely defeats even magnetic media data recovery technique is to encrypt your entire hard drive and thus all of the data on it. While the encrypted data could technically be recovered, it is of little value without also having the encryption key or being able to crack the encryption algorithm.

Article C4911 - August 25, 2011 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

11 Comments
Yeppers
August 25, 2011 1:28 PM

Leo, why do you think Microsoft does not include a “secure delete” function in their Windows program? (Do Apple computers have that function?) It seems like it would be an incredibly useful function to have, and it would rid us of that nagging “was it really permanently deleted” question we have at times.

Mike
August 25, 2011 1:38 PM

I think this might also be a reason to put your data on a separate partition. If you let Windows and the programs use one partition and put your data on another the chance is probably less that Windows will overwrite data you accidentally deleted.
Also, if you don't want to bother with secure delete tools you might be able to get similar results by simply defragging your hard drive. I've done it successfully before. I think it's most likely to work (as secure delete replacement) on a partition/disk that is quite full or that has lots of fragmented files.

Dave B
August 25, 2011 1:45 PM

There are also bits left at the end of sectors that have been reused. Typically the last sector in a chain used by a file is not completely filled. Any data that existed in that sector, not covered by new data, will remain. Information has been gleaned from these trailing sectors off of software installation disks by prying eyes - finding bits of old emails and documents from the original machine used to master the disks. This could reveal over 3k of data on a typical NTFS installation.

Mark J
August 25, 2011 3:01 PM

@Mike
The chances that MS will overwrite your file on a data partition are also fairly high, as it can and does overwrite deleted files with other data files. So the value of creating a partition for that reason is marginal at best.

Tony
August 25, 2011 9:29 PM

you can also use a program called REVO uninstaller it has a data or a so called perma delete function. i use it for deleting files only as i dont like ripping stuff from the reg. it's primary function is to remove leftover stuff after uninstall. but i dont use it like this.

Actually secure delete shows up in several utility programs. CCleaner is another, where it's called "Drive Wiper".
Leo
26-Aug-2011

Bob Maria
August 29, 2011 12:37 AM

Only deleting a file doesn't mean that now you have safely deleted a file and no one can recover it now. Delete only mark the flag to that space as free. To safely delete a file you can use "Kernel File Shredder"

as I mentioned in the article there are many, many free safe delete and file shredding utilities out there.
Leo
30-Aug-2011

Yuri
August 30, 2011 12:22 PM

Revo Unuinstaller have the option of permanently deleting data from hard drive.

Richard
August 30, 2011 4:06 PM

Dear Leo
I use the free program Recuva to overwrite primarily deleted pictures, but also deleted files.
Do you consider this a secure way to prevent these files being recovered ?. ( I realise that it is always possible for expensive and very sophisticated methods to recover virtually anything on a hard drive.)

I don't see a way in Recuva to overwrite files, only recover them. CCleaner, from the same company, has a secure overwrite feature.
Leo
31-Aug-2011

Bill
August 30, 2011 9:16 PM

What about accidentally deleting an email, particularly an old one? Would recuva work? How?

Typically no, but it REALLY depends on what email program you use.
Leo
31-Aug-2011

Mike
August 31, 2011 7:09 AM

I'm not worried enought about it to check it further, but even securely deleting a file often is insufficient. In some cases, there are MULTIPLE copies of the file in various subdirectories of your hard drive; some of them being Recent Files, or Temporary Internet Files, and more files. Some are buried so deeply and named so archaically that you have to be Indiana Jones to find them.

Anna
September 18, 2011 11:02 PM

Totally free file shredder programs available here,
http://data-security-freeware.blogspot.com/2011/04/free-data-shredders-erase-folder-file.html

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.