Is deleting a file and emptying my recycle bin enough?

Deletion, deletion and deletion

There are actually three ways that files can be deleted. Each has a different chance of being recovered.

• Moving to the Recycle Bin. When you delete a file in Windows Explorer or in some other applications, the file is not actually deleted at all, but rather simply moved to the Recycle Bin.

• Permanent delete. When you empty the Recycle Bin or delete a file in the Windows command prompt, or when most programs delete a file, the file is just removed from the list of files on the system. The area that the file's data previously occupied is marked as unused, but it is not otherwise erased.

• Secure delete. Secure delete operates like permanent delete but it takes the extra step of overwriting the area previously occupied by the file's data. Because of this, secure delete is often more time-consuming. Secure delete also typically requires additional tools that are not part of Windows.

In common usage, file deletion is usually one of the first two: moving files to the Recycle Bin or some kind of permanent delete.

Recovery, recovery and recovery

Each of the three methods of deleting files have a corresponding approach to recovering what's been deleted. Some are easy, some are exceptionally difficult, and some require special tools, luck, and timing.

• Files that have been deleted by being moved to the Recycle Bin can be undeleted simply by moving them back. As you might imagine, that's exactly why the Recycle Bin exists. People were accidentally deleting files that they didn't mean to and the Recycle Bin acts as a safety net.

• Files that have been permanently deleted can sometimes be recovered by using undelete or recovery utilities. Because a so-called "permanent" delete doesn't actually overwrite the file's data, it is possible for software tools to rediscover or reconstruct the file from what's been left behind. This type of recovery requires both luck and timing as the data previously occupied by the deleted file is marked as available free space on disk. That means that files subsequently written to the disk could cause the deleted file's data to actually be overwritten. As Windows is constantly writing to the hard disk, the sooner that a recovery is attempted, then the higher are the chances of its complete success. It's not uncommon for me to recommend the program Recuva, which is one of many programs that perform this type of file recovery.

• Files that have been securely deleted can typically not be recovered. There can be exceptions, though. For example if the secure delete overwrites the data only once, there are advanced (and expensive) data recovery techniques that can use the residual magnetic field of previously stored data to attempt to recover it. That sounds complex because it is; as I said, it's both difficult and pricey.

What do you need?

What you need depends on your level of paranoia and the sensitivity of the data that you are deleting.

For most average users, the combination of the Recycle Bin and permanent delete is almost always sufficient. Couple that with making sure to fully erase the hard drive with a tool such as dban before discarding the machine and you have the vast majority of concerns covered.

If you have legitimate concerns, or are just feeling paranoid, a reasonable approach is to run a secure delete utility periodically to wipe the free space on your hard drive. This ensures that deleted files which have not yet been overwritten by other files cannot easily be recovered.

And finally, one approach that completely defeats even magnetic media data recovery technique is to encrypt your entire hard drive and thus all of the data on it. While the encrypted data could technically be recovered, it is of little value without also having the encryption key or being able to crack the encryption algorithm.