Introduction
Many users assume that deleting files on their Windows system will irretrievably remove them. However, this is a fallacy. Data that is deleted in a traditional manner is often not permanently destroyed and can be restored under certain circumstances. This article explains why deleting data on Windows – both on traditional hard drives and solid-state drives (SSDs) – is not really safe and what data recovery methods are available. In the following we generally refer to hard drives and SSDs as data carriers.
How deletion works under Windows
Normal deletion and the recycle bin
Deleting files in Windows via the context menu or by moving them to the Recycle Bin is the common method for most users to remove unwanted files. However, the file is not actually deleted from the disk. Instead, Windows simply removes the reference to the file in the file system and marks the space the file occupies as available for storing new data. The data itself remains on the disk until it is overwritten by new data.
Permanent deletion via Explorer
Even permanently deleting files by emptying the Recycle Bin or using the shift-delete combination, which removes files directly without going through the Recycle Bin, does not result in an immediate physical deletion of data from the disk. Similar to normal deletion, the references to the files in the file system are deleted and the space is marked as available.
Restoration possible at the touch of a button
In both cases, the data can be easily recovered using data recovery software such as O&O DiskRecovery. In addition, it is also possible to perform a deep search for fragments to reconstruct the files and even restore the table of contents of a deleted partition or hard drive.
Differences between hard drives and SSDs when deleting data
SSDs work differently than traditional hard drives. Because of their design and functionality, SSDs use a technology called wear leveling, which is designed to maximize the lifespan of the drive. This results in data being spread across the entire SSD and not always stored in the same physical location.
TRIM command for SSDs
Modern SSDs use the TRIM command, which tells the operating system which blocks of data are no longer in use and can be safely deleted. This improves the performance of the SSD and contributes to its lifespan. When the TRIM command is enabled, recovering data can be more difficult because the TRIM command causes the SSD to actually delete the data blocks marked as no longer needed.
Data recovery: methods and tools
Recovery options
The recoverability of data on hard drives and SSDs differs significantly. While deleted data on hard drives often remains until physically overwritten, data on SSDs that are marked as deleted by the TRIM command are often removed more permanently.
How data recovery software works
Data recovery programs like O&O DiskRecovery use advanced algorithms to examine physical hard drives for leftover files. They analyze the disks at a deeper level than the standard file system and can thus find file fragments that the operating system considers to be deleted. After scanning the disk, the software compiles a list of recoverable files that the user can then selectively get back.
Conclusion
Simply deleting files in Windows does not remove the physical data from the disk, only the references to it in the file system. Only when the storage space is overwritten is the data actually no longer recoverable. Understanding how deletion and recovery processes work is critical to protecting sensitive information. Users who want to ensure that their data is permanently deleted should use O&O SafeErase.