back

Recovering Deleted Data And Secure Deletion

Data that is “deleted” on most operating systems isn’t genuinely deleted from the disk. The data on the disk is still very much there. The place where it was stored on disk is marked to be overwritten when disk space is needed by another program. Depending on the size of the file and how much space is available on the disk, it may be recoverable with no damage or partly corrupted.

It Isn’t Bad

Overwriting disk space every time data is deleted and then writing over with new data when space needs to be used lowers the life span of a drive. With the system described before, this helps a disk last long. However, it clearly isn’t a good thing if you need to delete sensitive files.

How Do I recover?

Many different programs exist to read the data marked to be overwritten. This arch wiki page has some programs listed to use.

How Do I Delete Data?

First of all, SSD stores data differently so securely deleting data off an SSD with tools like shred is not a good thing. Stack exchange post discussing the matter. You can wipe an entire SSD but not securely delete individual files (not really anyways). For HDD, there are many programs that work great. I prefer using shred. Bad blocks on a HDD that may be read through other means later on can be bad too as it won’t be written over when securely wiping with something like shred. The best way to securely delete data on a disk is physically destroy the drive.