0

Would this make a file unrecoverable (Windows OS)?

  1. Delete the file (i.e. send it to the recycling bin).
  2. Empty the recycling bin (i.e. remove the reference to where the data is stored in memory).
  3. Overwrite the memory with different data (assume you knew the blocks of memory used, and forced those to be used with new data).

I've read that only once overwritten several times the data is truly unrecoverable. Is that true? How could the data be recovered if the memory where it was store has something else stored in it?

Pete Oakey
  • 214
  • 2
  • 4
  • 14
  • 1
    ...or [How often do you have to wipe/shred your files, to make them not undeletable](http://superuser.com/questions/270556/how-often-do-you-have-to-wipe-shred-your-files-to-make-them-not-undeletable) – bwDraco Sep 13 '15 at 01:06

1 Answers1

0

For magnetic drives every disk is made up of a partition (large container) each partition has a format (smaller containers) those smaller containers do come in variable sizes however a partition can only have a single size small container. The choices are; 512, 1024, 2048, 4096, etc bytes.

Each small container has a location (sector) each sector exists in a cluster and each cluster exists on a track. Each one of those sectors (small container id) is indexed, most of the time this index exists on the inner most track with MBR (Master Boot Record).

When one deletes a file the index id is marked as writable, the file is not actually deleted only forgotten. Lets say for speculation one writes a new file and it has written to that sector this would be a (first pass) technically the file is not deleted only one sector has been removed. One can easy rebuild the file and figure out the missing bytes the same way RAID drives do.

Let’s say every sector was overwritten this would be considered a complete first pass as each sector was over written once. Each sector has a limited read/writes once this limit has been reached the sector will become bad and locked by the index. A sector will go bad because changing a magnetic field from positive to negative the setting a 1 to 0 bit on a single sector will eventually polarize the area on the disk making a non readable sector.

Most data recovery software that is commercial and available to the public can read a few passes deep—think of seeing through a notebook to the page under it—and forensic software can read to the limitation of the sensitivity of a hard drive head. Professional data recovery operations will take the disks out of the drive and put them in a machine that has far more sensitive heads and as a last resort a Magnetic Force Scanning Tunneling Microscopy could read up to 10-20nm field variations.

All of the above is the physical aspect of storing a virtual file. One still has files that makeup operating systems and programs. One of Microsoft’s OS programs is shadow copy; it is a database that stores passes of sectors on your data. It lets you move in one direction and revert to specific time period to recover files.

So in answer the file is never deleted it is only forgotten and slowly fades away.

Giacomo1968
  • 53,069
  • 19
  • 162
  • 212
Jamin Quimby
  • 126
  • 2