what happens to deleted data and how to securely delete it

A common misconception that computer users have is, when you delete a file, it is completely removed from the hard disk.

However, you should know that highly sensitive files such as pictures, passwords, chat logs, and so forth still remain on the hard disk.

Even after they are deleted from your recycle bin, they are still located on the hard drive and can be retrieved with the right software.

Take for example when you use WinRAR to extract the file that someone sent you.

The program extracts the data to a temporary file before it reaches its destination on your hard disk; this may lead to a data leak. Any time that a file is deleted from a hard drive, it is not erased. What is erased are the bits of information that points to the location of the file on the hard drive. The operating system uses these pointers to build the directory tree structure (the file allocation table), which consists of the pointers for every other file on the hard drive. When the pointers are erased, the file essentially becomes invisible to the operating system.

The file still exists; the operating system just doesn't know how to find it.

Shadow data is the fringe data that remains on the physical track of storage media after it is deleted, sweeped, or scrubbed.

A mechanical device called a head is used to write the data, and it is stored electronically in magnetic patterns of ones and zeros.

The patterns are in the form of sectors which are written consecutively in concentric rings called tracks.

However, head alignment is just a little bit different each time an attempt is made to erase data, and data remnants sometimes bleed over the tracks.

This is the reason why government agencies require multiple scrubs or burning, because there is no guarantee of complete elimination of fringe, or shadow, data.

The only way that you can permanently delete this data is to override it with special software or wait for the operating system to overwrite the data.

There are files on the hard disk that do not have any pointers in the file allocation table so it will eventually be overridden with something new.

Even files that are fragmented or are partially written over are recoverable and can be used against you. Special software will overwrite these files securely and immediately.

One such recommended software that securely cleans the white space is CCleaner.

As a word of note, people suggest that's simply defragging a hard drive will overwrite these pointers; this is not true. Drives formatted using NTFS are especially not affected using this method. This is because of the way NTFS stores data; it essentially makes defragging the hard drive useless.

Deleting Data Securely

As mentioned before, when you delete data, it is not actually deleted and can be easily recovered. To prevent data from being recovered you must secure erase (or shred) the data. What special programs do to securely erase contents from a computer is they enumerate through each bit of data and replace it with a random bit. The shredding method I recommend is 7 passes. This process makes the bits unknown as recovery of this data difficult, if not impossible. This can be done with file eraser programs, or it can be done to the entire drive with bootable software. DBAN is recommended if you are trying to erase your entire drive. Note however, DBAN does not erase bad sectors or HPA/DCO areas. Some programs such as Blancco implement HPA/DCO wiping by default, other tools could allow the user to choose whether or not to wipe HPA/DCO while other tools are not able to wipe HPA/DCO at all. 

HPA stands for Host Protected Area and is a section of the hard drive that is hidden for the operating system and the user.

The HPA is often used by manufacturers to hide a maintenance and recovery system for the computer.

For this reason, the HPA is not a big concern, but you can securely remove data here nonetheless. A DCO is a Device Configuration Overlay and is another hidden area of today’s hard drives. Similar to the HPA, the DCOs can be securely erased in such the same way. 

While recovery of information wiped out in this manner is far more difficult, and in many cases impossible, some recovery techniques exist that specialists can employ to retrieve some of the data. 

Factors such as the size of the hard drive, the accuracy of the mechanical system in the drive, the power with which the information was recorded, and even the length of time the information was left on the drive prior to wiping all will have an effect on the probabilities for recovery. 

Another method is to physically destroy the hard drive to a state that is irreparable. The best method for this is to open the hard disk and grind the platters to obliterate all data. Another method for hard drives that use disks is to use an industrial strength magnet to remove the data. Optical disks (CD’s, DVD’s, etc.) can be shredded if they are not writable. Also, optical disks can be destroyed be cooking them and is the best method for destroying data on optical media. Cooking them however is not recommended for practicing or everyday use as they release a toxic fume.