How were files recovered that I thought were deleted?
Hi, everyone. Leo Notenboom here for Ask Leo dot com. This
is a kind of spooky one if it catches you by surprise. Let's
get right to the question. "My son brought up some files in my
computer that I had deleted such as Emails in my Yahoo
account, deleted photos, and deleted conversations on Yahoo
Messenger. How is this possible? And where do I go in
my computer to get rid of that information and how do I
prevent this from happening again?" It's long been one of
those rules of thumb that we often grasp at that deleted
isn't really deleted. Until of course, you need something
that's been deleted and you can't get it back but the
bottom line is that deleting for a variety of reasons and in
a variety of places doesn't always mean that things are
completely and irretrievably deleted. Let's look at a couple
of different ways that various things might not have really
been deleted even though you said to delete them. One of the
things that can happen of course is that you might assume
that there's a delete going on but it's not. One of the
examples, the best example I have of this that continues to
surprise people all the time is your web browser cache . When you
visit websites, the web browser downloads the the page, the
images, the whatevers from the various pages that you visit
and it places them in what's called a cache. When you go on
to visit another page, those files are deleted. They're left
there on purpose actually. A good example would be the logo
on askleo.com. When you visit one page, the first page
you visit downloads the logo. When you visit another page,
that has the same logo on it, there's no need to download it
again. It's a very important speed enhancement that allows
you to view pages much quicker than if the browser needed to
download every image over and over and over again. Now, how things
get deleted from the ccache is kind of mysterious because it
depends on how big the cache is, which browser you're using, how
many pages you've been visiting, all that kind of
stuff. The intent is that the browser deletes the old stuff
automatically when it needs to make room for newer things.
Again, that can be sometimes a little difficult to put a brain
around because when you take a look at what you've been
looking at, things you think might have been old, aren't
things that might be new, get deleted, it gets complicated
pretty quickly and of course, when you empty your cache
manually, then, those things really are deleted. The
scenario where this comes up, that surprises most people is
when they actually have a picture that they've
downloaded, they happen to manage to browse into their
cache where they're looking at photographs and all of a
sudden, all these old photos that seen before from browsing
the web days, months, weeks ago suddenly reappear as they're
browsing as they're looking around on their hard disk. So,
clearing your cache is one example. I have to say it's
just one example because honestly, all sorts of
different programs may do similar things and may actually
not delete things when you think they might be deleted.
It's kind of up to whatever that program decides is the
most efficient for how it gets used. Remember, deleting
something means if you need the something you need to get it
again. That's why the browser cache is a speed improvement but
for other programs doing other things, there may be other
reasons for them to at least defer deleting the kinds of
things that you might otherwise think or deleted. Now, one of
the more obvious examples of things not being deleted when
you literally say delete is the recycle bin. By definition,
when you in Windows File Explorer delete a file, it gets
moved to the recycle bin instead of being deleted. What
that means is that if you change your mind which is an
incredibly common thing to have happen, you can simply go to
the recycle bin and recover your file. That's why the
recycle bin exists. So, one way to make sure that things are
really deleted is to either not use the recycle bin. In other
words, you can like shift, delete, instead of delete and
it'll bypass the recycle bin. You can turn the recycle bin
off or more commonly, you can simply empty the recycle bin
once in a while when you know you Need to make sure that
there's nothing in it. Now, even so, even so and this is
the one that I think that a lot of people hang a lot of hope on
when they accidentally delete a file is that when you delete a
file, in Windows, and many other operating systems. The
data for that file is not overwritten. In other words,
basically, a pointer to the file, something that says, hey,
the data for this file, Food.TXT is over there. Well,
the pointer away. The name Food.TXD goes away but that
data's still over there. What that means is that recovery
programs can sometimes the way disks are laid out, go back and
reconstruct the file from the data that remains on the disk.
The only way to deal with this is to use what's called a
secure delete program that actually make sure to not just
delete the file, the pointer to the file but actually overwrite
the data or add you've deleted a number of files, use what's
called a free space wiper because the data that used to
be the file is now available for other files to overwrite
and it remains there until they do. It's in free space. What a
free space wiper does is it literally goes and writes data
in all of the unused area of your hard disk so that no files
can be recovered using these kinds of mechanisms. Something
people miss all the time. The file was backed up. In other
words, you deleted the file on Tuesday but you forgot that, oh
yeah, Monday's backup of my machine is gonna have a copy of
that file. For better or for worse, in other words,
sometimes, it's a safety net that allows you to get a
deleted file back. Sometimes, it's an embarrassment when a
deleted file comes back to haunt you but the bottom line
is that backups need to be factored into all of this for
sure. Backups do contain old copies of the files and they're
around as long as the backup themselves are kept. So, when
it comes to making sure that gone is gone, you do need to
understand how the programs you use deal with deleting things
that they may or may not delete immediately. The browser cache
being one example but many other programs fall into this
category. Empty the recycle bin. To make sure that things
are gone, every so often, empty the recycle bin. That makes it
non trivial to get the file back you really need to know
that you don't want it back ever but it is a very quick and
very easy thing to do and finally, if you really are
concerned about files that have been truly deleted, emptied
from the recycle bin, deleted in other ways, then, make sure
to run a free space wiper or to delete those sensitive files
using a secure delete tool. Now, whenever I have a
discussion about data recovery, deleted files, and such, I also
have to at least talk about what I call further
incantations to raise the dead. The thing is, especially on
magnetic media. It may be possible even if we've done all
the things we've talked about for what I'll refer to as
advanced forensic data recovery techniques to be able to
recover some or all of the information that's been deleted
from a hard disk. It's rare. It's becoming rarer because
it's much harder on SSDs but the bottom line is that
magnetic media sometimes can leave traces even of erased
files. Now, to be clear, this is not easy. In fact, it's
expensive and it typically involves taking a hard disk to
a clean room and taking it apart and using special
equipment to analyze the data that's on that disk. But for
completeness, I do have to point out that this is one of
those things that can in some cases come back to haunt some
people. The solution, by the way, to dealing with this is
twofold. We have two choices. One is overwrite the data
multiple times because that's what makes it difficult to do.
You'll take a look at some of the disk space or disk wiping
software and they'll actually give you a choice. Do you want
me to overwrite this once or five times or thirty times?
Couple of times is plenty. Trust me on that, but bottom
line is you can say overwrite this multiple times. The other
approach that is surprisingly easy and surprisingly
transparent is to use whole disk encryption because once a
is encrypted, it doesn't matter if they can recover the bits.
They still won't be able to decrypt them. So, something
like Bit Locker or Vera Crypt or any of the others that
support a whole disk encryption format, those are also great
ways to ensure that the data won't come back from the dead
to surprise you at some point in the future. Hope that was
helpful. For updates, for related links, for comments,
and more, visit Ask Leo.com/3661. I'm Leo
Notenboom. This is askleo.com Thanks for watching.