"deleting a file erases it"

IT supportsecurityprivacy

Delete removes the directory entry and marks the space reusable - the bytes remain until overwritten, which recovery tools exploit daily.

NIST SP 800-88 defines the real spectrum: clear, purge, destroy. SSDs complicate it further - wear leveling scatters copies, so encryption-plus-key-destruction became the practical purge.

Deleting a file usually removes its directory entry and marks its space as available, without touching the contents. The data remains on the medium until something else happens to overwrite it, which is why recovery tools work and why a deleted file is not a gone file.

On traditional magnetic drives, overwriting was a reliable answer, and that is where the folklore about multiple passes comes from. Modern research indicates a single overwrite is sufficient on those drives, and the multi-pass ritual is a leftover from much older recording densities.

Solid state storage changed the problem rather than solving it. Wear levelling means the controller decides where data physically lives, so overwriting a logical block writes somewhere else entirely and the original contents remain in a cell the operating system cannot address. Reliable erasure therefore requires the drive's own secure erase command, and the answer that survives every media type is to encrypt from the beginning: destroy the key and the remaining ciphertext is unrecoverable regardless of where it physically sits.

Disputed / commonly mistold A popular version of this story is inaccurate - see the note above.

← All glossary entries