question about deletions.....im curious - Tilted Forum Project Discussion Community

simonrex22 · 08-09-2003, 05:38 PM

This idea has been running through my head the past few weeks. What exactly does happen to files when they are deleted. Yeah, I know they go to the recycle bin, but what about after you empty the recycle bin. Where does it go? What happens to it? Does it just get worked back into the system somehow? Does it electronically evaporate. Where does all that data go?

Silvy · 08-09-2003, 05:48 PM

Depending on the filesystem your computer uses different things happen..
But usually it works like this:

Filenames are saved all bunched up together in one area of the disk. That is called the FAT (File Allocation Table). Next to every filename in the FAT is an 'address' of the contents of that file...

So if you draw the layout of the disk, you'd have many names in one section, pointing to all directions at different areas of the disk.

Because the filename points to said location, your computer knows that space of the disk is used. When you delete your file, the computer just removes the name from the FAT. (not the pointer, see notes)

That way the location is no longer being pointed to, and the space is thereby free.
(while the actual contents are still there)

---- Notes:
That's how undelete works: it puts the filename right back at the pointer.

Not all filesystems behave this way. Some completely destroy any record of that file (making undelete impossible as the system won't know where the file started). (specialized software can still guess contents of files....)
Other filesystems completely overwrite even the contents of the file making data recovery (near-) impossible.

I'm not sure here: but DOS did not actually remove the filename either... It just emptied the first character of the filename. Then the system would know that the space taken up by the file was available, yet if you wanted to undelete you would only have to guess the first character of the filename.

simonrex22 · 08-09-2003, 05:59 PM

Thank you, that helped a little bit. But im still not sure about what happens to it after it is over written. Is the data just transformed or something. I just asked my dad and he said something about magnets. And in the other case where it just gets rid of the pointer, does that data just stay on your harddrive.

Latch · 08-09-2003, 06:15 PM

Quote:

Originally posted by Silvy

I'm not sure here: but DOS did not actually remove the filename either... It just emptied the first character of the filename. Then the system would know that the space taken up by the file was available, yet if you wanted to undelete you would only have to guess the first character of the filename.

THAT'S why the undelete always made me put in the first letter of the file. Wow, solved a major mystery for me hehe.

Silvy · 08-09-2003, 06:23 PM

You're correct on the pointers...

FIRST: something on the organization of data on the disk
The harddrive (and floppy drive too...) is made up of small blocks. Each block can hold a little piece of data.

A file that is larger than a single block gets its data written in the first available block (say nr 100). When that block is full it goes on to write thing in the next avail. block (say 101). Now in block 100 it will write that the file is continued in block 101.

So you could have a file in blocks like this:
100 -> 101 -> 200 -> 201
(the system will ofcourse skip blocks that are already occupied by data from other files)

Now in the FAT there is a list like this:
File1 (starts at) -> 103
File2 (starts at) -> 100
File3 etc.

Now if you remove File1 you'll have this:
(first character remove denotes a free 'chain')
?ile1 (starts at) -> 103
File2 (starts at) -> 100
File3 etc.

This allows the system to find free blocks (just follow the trail from "?ile1". It does not need to actually empty the contents or remove the links (between 100 and 101).
essentially keeping the file intact.

---> I'm assuming you're aware that computer information is stored in bits and bytes for the next answer
On to the more technical side: You're father is right!

A harddisk consists of spinning disks and a head (like a vinyl record player)
the disk has a rough surface consisting of many (very, very small) pieces of metal. By using a magnet, you can point these pieces of metal in different directions.
The head has a very small electromagnet that can point each of these pieces of metal independently.
These pieces of metal are commonly called 'bits' They can have 2 values: 0 and 1 (or on the disk: 'left' and 'right' pointing)

When you write a file to disk the head looks up an empty spot (it can also 'feel' the bits) and constantly manipulates these free bits to make a pattern that matches your file.

The Fat is somewhat like any other information on the disk, it needs to be written with that head. So when you delete a file, the system changes the first character of the filename in the FAT, by rearranging that part of the disk... Just so it matches '?ile1' instead of 'File1'

Notes:
- These are the basics probably many people could elaborate or even correct me, but the essence should be correct.
- The actual emptying of a file (overwriting its contents) amounts to all '0's as the file pattern.
- I've used a '?' to mark an empty character.

Hope I've helped answer your question....

Silvy · 08-09-2003, 06:26 PM

Quote:

Originally posted by Latch
THAT'S why the undelete always made me put in the first letter of the file. Wow, solved a major mystery for me hehe.

I know exactly how you feel... I was enlightened quite a few years ago, but felt exactly the same...
I always figured: If it can recover everything, why not that one character?

FastShark85 · 08-09-2003, 06:26 PM

I read somewhere that the only way to truly clean a hard drive to eliminate the ability to recover deleted data is to first delete all files, then fill the hard drive to capacity with crap files, re-format and repeat the fill/re-format several times.

Silvy · 08-09-2003, 06:35 PM

Quote:

Originally posted by FastShark85
I read somewhere that the only way to truly clean a hard drive to eliminate the ability to recover deleted data is to first delete all files, then fill the hard drive to capacity with crap files, re-format and repeat the fill/re-format several times.

That is true... Because the bit manipulation I talked about earlier is not 100% accurate...

Let's say this is the movement space of the bit:

0---------------x---------------1

(a bit pointing to the left is read as a binary '0' and a bit pointing to the right of the 'x' is read as a binary '1')

Now this is a 0:
0-|-------------x---------------1

And this is a 1:
0---------------x-------------|-1

But If I change the one to a zero and vice versa and I'm not 100% thorough you get this:

the new 1:
0---------------x-------|-------1

the new 0:
0-------|-------x---------------1

You see that there is still an 'influence' of the old values, while they will still be read correctly as 1 and 0.

With sophisticated equipment you can read these influences from a disk and thus recover (or guess) the contents of earlier files.

Popular recommendations are swipe the disk (write all 1's and then all 0's) 7 times for full destroying of sensitive data.

Hope this makes a little sense.. it's getting pretty late for me...

MSD · 08-09-2003, 07:59 PM

The only way to truly destroy data is to bend and burn the hard drive plate. When my father worked in IT, he worked on contract with a hotel chain, and before anything was discarded, he had to drive nails through the hard drives and then bend the plates to make sure nobody was going to get anything out of the trash.

obediah · 08-09-2003, 10:30 PM

Data recovery is all about how much money you have. Even a bent plate with a nail through it could probably be read. People have pulled drives out of lakes, fires (where sprinklers had gone off after the fire), and other unlikely situations and pulled at least fragments of files of the disk. There ain't much worth the cost of these procedures, but some people do specialize in them.

If my life depended on a hard drive being erased, I'd completely overwrite the disk with random data a dozen times, then physically take apart the drive and break it into as many pieces as possible, burn what I could and then spread the peices in dumpsters around town.

Mephisto2 · 08-10-2003, 02:08 PM

Quote:

Originally posted by obediah
Data recovery is all about how much money you have. Even a bent plate with a nail through it could probably be read. People have pulled drives out of lakes, fires (where sprinklers had gone off after the fire), and other unlikely situations and pulled at least fragments of files of the disk. There ain't much worth the cost of these procedures, but some people do specialize in them.

If my life depended on a hard drive being erased, I'd completely overwrite the disk with random data a dozen times, then physically take apart the drive and break it into as many pieces as possible, burn what I could and then spread the peices in dumpsters around town.

That's why many companies literally shred their disks.

Certainly in Ireland the police force does this.

The HDD's are dumped into this large industrial shredder. This works like a wood chipper and spits out little metal chunks the size of your small finger nail. And yes, it actually pulverizes the metal disks.

VERY noisy and the best way to ensure no one gets at that data...

Mr Mephisto

FunHater · 08-10-2003, 05:13 PM

Wow, and before reading this thread I just thought it was all magic.

Silvy · 08-10-2003, 05:21 PM

It's true about data recovery...
Once saw a Crime documentary... a guy cut a floppy disk in like 10 pieces, and then mangled them with his hand...

They recovered a lot of incriminating evidence from that disc... It wasn't easy, but it was proven possible.

Pragma · 08-10-2003, 05:31 PM

The NSA/Department of Defense certification, from what I've read (you can find a lot on .gov public websites) is 13 successive overwrites (all 1s, then all 0s, then all 1s, etc.).

Then they take the harddrives through a "bulk eraser." For what that does, think of what happens when you hit "DeGauss" on a monitor, and imagine a fucking huge magnetic field hitting the harddrive.

Then they take steel wool scrub brushes and polish the harddrives.

Silvy · 08-10-2003, 05:33 PM

Nothing like being thorough... I guess they upped the number from 7 to 13 then...

Pragma · 08-10-2003, 05:36 PM

Might have been 7, it's been a while since I looked at it.

Either way, you'd be pretty hard pressed to recover data from it.

Silvy · 08-10-2003, 05:43 PM

So true... i might have a slight notion of how it works...
But if it ain't hooked up to my PC it's lost to me...

So next time I've had a HD crash.. I'll fake a murder, turn myself in and suggest that there might be an e-mail on the disk that proves I did it...

Pragma · 08-10-2003, 06:03 PM

Haha, nice. "Gee, it looks like we'll have to let you go, as it turns out you're innocent. Sorry for the hassle. Oh, by the way, here's your harddrive back."

catback · 08-11-2003, 02:36 PM

don't save child porn on your computer and you'll be safe

Boner · 08-11-2003, 03:06 PM

Quote:

Originally posted by Mr Mephisto

The HDD's are dumped into this large industrial shredder. This works like a wood chipper and spits out little metal chunks the size of your small finger nail. And yes, it actually pulverizes the metal disks.

I used to work with a former air force IT guy. He said they used to take the drive platters and put them into a machine that ground them up into metal shavings.

08-09-2003, 05:38 PM	#1 (permalink)
simonrex22 Insane	question about deletions.....im curious This idea has been running through my head the past few weeks. What exactly does happen to files when they are deleted. Yeah, I know they go to the recycle bin, but what about after you empty the recycle bin. Where does it go? What happens to it? Does it just get worked back into the system somehow? Does it electronically evaporate. Where does all that data go?

08-09-2003, 05:48 PM	#2 (permalink)
Silvy paranoid Location: The Netherlands	Depending on the filesystem your computer uses different things happen.. But usually it works like this: Filenames are saved all bunched up together in one area of the disk. That is called the FAT (File Allocation Table). Next to every filename in the FAT is an 'address' of the contents of that file... So if you draw the layout of the disk, you'd have many names in one section, pointing to all directions at different areas of the disk. Because the filename points to said location, your computer knows that space of the disk is used. When you delete your file, the computer just removes the name from the FAT. (not the pointer, see notes) That way the location is no longer being pointed to, and the space is thereby free. (while the actual contents are still there) ---- Notes: That's how undelete works: it puts the filename right back at the pointer. Not all filesystems behave this way. Some completely destroy any record of that file (making undelete impossible as the system won't know where the file started). (specialized software can still guess contents of files....) Other filesystems completely overwrite even the contents of the file making data recovery (near-) impossible. I'm not sure here: but DOS did not actually remove the filename either... It just emptied the first character of the filename. Then the system would know that the space taken up by the file was available, yet if you wanted to undelete you would only have to guess the first character of the filename. __________________ "Do not kill. Do not rape. Do not steal. These are principles which every man of every faith can embrace. " - Murphy MacManus (Boondock Saints) Last edited by Silvy; 08-09-2003 at 05:50 PM..

08-09-2003, 06:23 PM	#5 (permalink)
Silvy paranoid Location: The Netherlands	You're correct on the pointers... FIRST: something on the organization of data on the disk The harddrive (and floppy drive too...) is made up of small blocks. Each block can hold a little piece of data. A file that is larger than a single block gets its data written in the first available block (say nr 100). When that block is full it goes on to write thing in the next avail. block (say 101). Now in block 100 it will write that the file is continued in block 101. So you could have a file in blocks like this: 100 -> 101 -> 200 -> 201 (the system will ofcourse skip blocks that are already occupied by data from other files) Now in the FAT there is a list like this: File1 (starts at) -> 103 File2 (starts at) -> 100 File3 etc. Now if you remove File1 you'll have this: (first character remove denotes a free 'chain') ?ile1 (starts at) -> 103 File2 (starts at) -> 100 File3 etc. This allows the system to find free blocks (just follow the trail from "?ile1". It does not need to actually empty the contents or remove the links (between 100 and 101). essentially keeping the file intact. ---> I'm assuming you're aware that computer information is stored in bits and bytes for the next answer On to the more technical side: You're father is right! A harddisk consists of spinning disks and a head (like a vinyl record player) the disk has a rough surface consisting of many (very, very small) pieces of metal. By using a magnet, you can point these pieces of metal in different directions. The head has a very small electromagnet that can point each of these pieces of metal independently. These pieces of metal are commonly called 'bits' They can have 2 values: 0 and 1 (or on the disk: 'left' and 'right' pointing) When you write a file to disk the head looks up an empty spot (it can also 'feel' the bits) and constantly manipulates these free bits to make a pattern that matches your file. The Fat is somewhat like any other information on the disk, it needs to be written with that head. So when you delete a file, the system changes the first character of the filename in the FAT, by rearranging that part of the disk... Just so it matches '?ile1' instead of 'File1' Notes: - These are the basics probably many people could elaborate or even correct me, but the essence should be correct. - The actual emptying of a file (overwriting its contents) amounts to all '0's as the file pattern. - I've used a '?' to mark an empty character. Hope I've helped answer your question.... __________________ "Do not kill. Do not rape. Do not steal. These are principles which every man of every faith can embrace. " - Murphy MacManus (Boondock Saints)

08-10-2003, 05:21 PM	#13 (permalink)
Silvy paranoid Location: The Netherlands	It's true about data recovery... Once saw a Crime documentary... a guy cut a floppy disk in like 10 pieces, and then mangled them with his hand... They recovered a lot of incriminating evidence from that disc... It wasn't easy, but it was proven possible. __________________ "Do not kill. Do not rape. Do not steal. These are principles which every man of every faith can embrace. " - Murphy MacManus (Boondock Saints)

08-10-2003, 05:31 PM	#14 (permalink)
Pragma I am Winter Born Location: Alexandria, VA	The NSA/Department of Defense certification, from what I've read (you can find a lot on .gov public websites) is 13 successive overwrites (all 1s, then all 0s, then all 1s, etc.). Then they take the harddrives through a "bulk eraser." For what that does, think of what happens when you hit "DeGauss" on a monitor, and imagine a fucking huge magnetic field hitting the harddrive. Then they take steel wool scrub brushes and polish the harddrives. __________________ Eat antimatter, Posleen-boy!

08-09-2003, 05:59 PM	#3 (permalink)
simonrex22 Insane	Thank you, that helped a little bit. But im still not sure about what happens to it after it is over written. Is the data just transformed or something. I just asked my dad and he said something about magnets. And in the other case where it just gets rid of the pointer, does that data just stay on your harddrive.

08-09-2003, 06:26 PM	#7 (permalink)
FastShark85 Psycho Location: In the garage, under the car.	I read somewhere that the only way to truly clean a hard drive to eliminate the ability to recover deleted data is to first delete all files, then fill the hard drive to capacity with crap files, re-format and repeat the fill/re-format several times.

08-09-2003, 07:59 PM	#9 (permalink)
MSD The sky calls to us ... Super Moderator Location: CT	The only way to truly destroy data is to bend and burn the hard drive plate. When my father worked in IT, he worked on contract with a hotel chain, and before anything was discarded, he had to drive nails through the hard drives and then bend the plates to make sure nobody was going to get anything out of the trash.

08-09-2003, 10:30 PM	#10 (permalink)
obediah Crazy	Data recovery is all about how much money you have. Even a bent plate with a nail through it could probably be read. People have pulled drives out of lakes, fires (where sprinklers had gone off after the fire), and other unlikely situations and pulled at least fragments of files of the disk. There ain't much worth the cost of these procedures, but some people do specialize in them. If my life depended on a hard drive being erased, I'd completely overwrite the disk with random data a dozen times, then physically take apart the drive and break it into as many pieces as possible, burn what I could and then spread the peices in dumpsters around town.

08-10-2003, 05:13 PM	#12 (permalink)
FunHater Tilted Location: Sherwood Park, AB	Wow, and before reading this thread I just thought it was all magic.

08-10-2003, 05:33 PM	#15 (permalink)
Silvy paranoid Location: The Netherlands	Nothing like being thorough... I guess they upped the number from 7 to 13 then... __________________ "Do not kill. Do not rape. Do not steal. These are principles which every man of every faith can embrace. " - Murphy MacManus (Boondock Saints)

08-10-2003, 05:36 PM	#16 (permalink)
Pragma I am Winter Born Location: Alexandria, VA	Might have been 7, it's been a while since I looked at it. Either way, you'd be pretty hard pressed to recover data from it. __________________ Eat antimatter, Posleen-boy!

08-10-2003, 05:43 PM	#17 (permalink)
Silvy paranoid Location: The Netherlands	So true... i might have a slight notion of how it works... But if it ain't hooked up to my PC it's lost to me... So next time I've had a HD crash.. I'll fake a murder, turn myself in and suggest that there might be an e-mail on the disk that proves I did it... __________________ "Do not kill. Do not rape. Do not steal. These are principles which every man of every faith can embrace. " - Murphy MacManus (Boondock Saints)

08-10-2003, 06:03 PM	#18 (permalink)
Pragma I am Winter Born Location: Alexandria, VA	Haha, nice. "Gee, it looks like we'll have to let you go, as it turns out you're innocent. Sorry for the hassle. Oh, by the way, here's your harddrive back." __________________ Eat antimatter, Posleen-boy!

08-11-2003, 02:36 PM	#19 (permalink)
catback Psycho Location: North America	don't save child porn on your computer and you'll be safe