Deleting a file feels final. It is not — in most cases the data is still sitting on the disk, entirely intact, waiting to be overwritten by something else. Understanding what deletion actually does explains both why file recovery works and why, on modern hardware, the traditional advice about secure erasure has quietly stopped being correct.
What deletion does
It removes the directory entry — the pointer that says "a file called report.pdf lives at these blocks" — and marks those blocks as free. The bytes are untouched. The file becomes invisible and its space becomes available, and those are two different things.
The mechanism
A filesystem keeps two separate things: an index of names and locations, and the data itself. Deletion touches only the first.
The reason is performance. Erasing 2.4MB means writing 2.4MB of zeros; removing a pointer means changing a few bytes. On a large file the difference is between instantaneous and several seconds, and for a folder of thousands of files it would be intolerable.
Recovery software exploits exactly this. It scans the filesystem for records marked available but still containing valid block lists, and reads the data back. If nothing has been written to those blocks in the meantime, the file is recovered perfectly.
⚠️ Stop writing immediately
Recovery chances fall with every write to that volume. Installing recovery software onto the drive you want to recover from is a common and self-defeating mistake — the installer may land precisely on the blocks you were trying to save.
Power the machine down, remove the drive, and work on it from another computer. Or at minimum run recovery software from a USB stick and write the recovered files to a different drive.
The layers before real deletion
| Stage | What it does | Recovery |
|---|---|---|
| Recycle Bin / Trash | Moves the file, does not delete it | Trivial |
| Shift+Delete | Removes the directory entry | Usually possible |
| Formatted (quick) | New empty index; data intact | Often possible |
| Formatted (full) | Writes zeros across the volume | Very unlikely |
| Overwritten | New data in the same blocks | No — on a hard drive |
| TRIMmed (SSD) | Controller erases the cells | No |
The Recycle Bin is worth understanding precisely: it is an ordinary hidden folder. "Deleting" moves the file into it and records the original path so it can be restored. Nothing is removed, which is why emptying the bin can take time on large files and why the bin counts against your free space.
A quick format is not erasure at all. It writes a fresh empty filesystem structure and leaves every block untouched, which is why "I formatted it by mistake" is one of the more recoverable disasters. A full format writes zeros and genuinely does erase.
Why SSDs changed everything
This section matters because the widely-repeated advice about deletion and secure erasure was formed in the era of mechanical drives, and much of it is now wrong.
Flash cannot overwrite
A mechanical drive can rewrite any sector in place — the head magnetises it to the new value. Flash memory cannot. A flash cell must be erased before it can be written, and erasure works on large blocks (megabytes) while writing works on small pages (kilobytes).
So an SSD never overwrites in place. It writes the new version to a fresh page, updates its internal mapping table, and marks the old page as stale. That old page still contains the old data.
Wear levelling makes it worse
Flash cells wear out after a finite number of erase cycles, so the controller deliberately spreads writes across the whole drive. It also maintains hidden over-provisioned capacity the operating system cannot address at all.
🚨 Overwriting does not securely erase an SSD
Writing zeros over a file tells the drive to store zeros — somewhere. The controller writes them to fresh cells and leaves the original data sitting in cells that are now unmapped and unreachable by the operating system, but perfectly readable by anyone who can address the flash directly.
Every "secure delete" utility that works by overwriting is therefore ineffective on flash storage. This includes SSDs, USB sticks, SD cards and phone storage. It was sound advice for mechanical drives and does not transfer.
TRIM cuts the other way
TRIM is the operating system telling the drive "these blocks no longer hold anything useful". The controller can then erase them during idle time so they are ready for future writes.
The consequence for recovery is dramatic: on a mechanical drive a deleted file may persist for months, while on a TRIM-enabled SSD it can be genuinely gone within minutes. Recovery tools often return nothing at all, and there is no way around it — the cells have been electrically erased.
What survives elsewhere
Even a properly deleted file leaves traces in places most people never consider:
| Location | May contain |
|---|---|
| Filesystem journal | Metadata, and small file contents |
| Volume Shadow Copy / Time Machine | Complete earlier versions |
| Thumbnail caches | Images of deleted photos and documents |
| Search index | Extracted text content |
| Page file / swap | Anything that was in memory |
| Hibernation file | A complete memory image |
| Application temp files | Autosaves and working copies |
| Cloud sync history | Versions and deleted-item retention |
| Backups | Everything, by design |
The thumbnail cache is a particularly persistent one. Windows and macOS both generate previews and store them in a central database, and deleting the original does not remove the thumbnail. A recognisable image of a deleted document can survive long after the document itself is unrecoverable.
File carving
When the filesystem index is gone entirely — a full reformat, a corrupted partition table — recovery tools fall back to carving: scanning the raw disk for the signatures that mark the start of known file types.
Carving has two well-known limitations. It cannot recover filenames, because those lived in the index — recovered files come out as file0001.jpg. And it assumes files are contiguous, so a fragmented file is recovered only up to its first fragment boundary. On a heavily used drive, that is a real constraint.
Erasing data properly
| Method | Hard drive | SSD | Notes |
|---|---|---|---|
| Overwrite with zeros | Effective | Ineffective | Wear levelling defeats it |
| Multi-pass overwrite | No better than one | Ineffective | Obsolete advice |
| ATA Secure Erase | Effective | Effective | Firmware-level, erases everything |
| NVMe Format / Sanitize | — | Effective | The modern equivalent |
| Encrypt, then destroy the key | Effective | Effective | The most reliable approach |
| Physical destruction | Absolute | Absolute | Shred the platters or the chips |
✅ Crypto-erasure is the right default
Enable full-disk encryption — BitLocker, FileVault, LUKS — from the day you set the machine up. Every byte that ever reaches the disk is then ciphertext, wherever the controller chose to put it.
To erase, destroy the key. Every copy, every remapped block, every fragment in over-provisioned space becomes unreadable simultaneously. This is exactly what a phone factory reset does, and it is why erasing 512GB takes a second rather than an hour.
The critical detail: the encryption must have been in place before the data was written. Encrypting a drive that already holds sensitive data does not retroactively protect the unmapped fragments of the old plaintext.
The multi-pass myth
The advice to overwrite 35 times comes from a 1996 paper by Peter Gutmann, which addressed the encoding schemes used by drives of that era and the theoretical possibility of reading residual magnetism with specialist equipment.
Gutmann himself later noted the method had become obsolete. Modern drives use far higher densities and different encoding, and no published research demonstrates recovery after a single overwrite. NIST's media sanitisation guidelines accept one pass. The 35-pass procedure survives mainly as folklore, and it wastes hours.
Deletion in cloud storage
Cloud deletion is a different thing again, because the provider's priority is durability — losing your data is a far worse outcome for them than keeping it slightly too long.
- Trash retention — typically 30 days before permanent removal.
- Version history — earlier versions survive independently of the current file.
- Replication — data exists in several datacentres and deletion must propagate.
- Backups — snapshots may retain it well beyond the retention window.
- Legal hold — in business accounts, an administrator can make deletion impossible.
When a provider says data is deleted, it generally means it is no longer accessible and is scheduled for removal from backups over some period. For anything genuinely sensitive, the only reliable approach is client-side encryption before upload — then their retention policy is irrelevant, because they never held anything readable.
Working with sensitive files?
Every tool here runs entirely in your browser — files are never uploaded, so there is no server copy to delete afterwards.
Browse all tools →Summary
- Deletion removes a pointer, not the data. The bytes stay until overwritten.
- Stop writing to the drive immediately if you need to recover something.
- A quick format erases nothing. It writes a new empty index.
- TRIM makes SSD deletion genuinely permanent within minutes.
- Overwriting does not erase an SSD. Wear levelling puts the new data elsewhere.
- Multi-pass overwriting is obsolete advice. One pass is sufficient on a hard drive.
- Encrypt first, destroy the key. The only erasure that works on every medium.
- Copies survive in journals, shadow copies, thumbnails, swap and backups.
Frequently Asked Questions
Is a deleted file really gone?
Usually not. Deleting removes the directory entry pointing at the data and marks its space as available for reuse. The bytes remain on disk until something else is written over them, which is why recovery software can often reconstruct files deleted hours or days earlier.
Can deleted files be recovered from an SSD?
Frequently not. When TRIM is enabled — the default on every modern operating system — the OS tells the drive which blocks are no longer in use, and the controller erases them during idle time. The data can be genuinely gone within minutes, which is very different from a mechanical hard drive.
Does overwriting a file securely erase it on an SSD?
No, and this surprises people. SSD wear levelling writes new data to different physical cells rather than the ones holding the old version, so an overwrite leaves the original data intact in a block the operating system can no longer address. Secure overwriting only works reliably on mechanical drives.
What is the most reliable way to erase data?
Full-disk encryption from the start, then destroy the key. If the data was never stored unencrypted, deleting the key makes every copy unrecoverable regardless of where the drive scattered it. This is how a phone factory reset erases hundreds of gigabytes in seconds.
Do I need to overwrite a hard drive multiple times?
No. The multi-pass advice comes from a 1996 paper about the encoding densities of that era's drives. Modern drives are far denser and a single pass of zeros is considered sufficient — the US NIST guidelines accept one overwrite. Multiple passes waste time without adding meaningful security.