What happens when you delete a file?

If you keep thinking about what happens to your files when you delete them, whether they are gone for good or if they are still lurking somewhere and can be recovered, you’re not alone. This kind of curiosity led me to investigate where deleted files go, what happens to them, and if they can be recovered.

What I’ve found out is that the deletion process is not as straightforward as it may seem. The files go through different deletion phases, which directly impact the fate of your erased files. If you want to learn more about this process and what information we may accidentally leave behind, keep on reading.

Where do deleted files really go?

There are several phases that deleted files go through, depending on which operating system you use. After you click the delete button, your files enter the first deletion phase, which moves them to the Recycle Bin or Trash. However, it doesn’t mean the file is deleted; instead, it’s hidden from its original location and can be restored by the user if necessary.

Things get tricky once the files move to the second phase of deletion, that is, being deleted from the Recycle Bin. Your computer locates all of your files using the NTFS (New Technology File System) tables if you use Windows or the APFS (Apple File System) if you use macOS.

These tables are similar to a book's table of contents, meaning that the computer registers all the files in these tables and assigns them information indicating where to find them within the system. After the file is deleted from the Recycle Bin, the computer also deletes the registry entry from the table, so it no longer knows where the file is. Yet, this doesn’t mean the file is completely gone, as the original bits of the file, containing 1s and 0s, are still stored on the drive, suggesting that the answer to the question "where do deleted files go" is actually nowhere.

Can deleted files be recovered?

Whether your deleted files can be recovered depends on the hardware you’re using and the phase of deletion your files are in. First, let’s discuss hardware.

Determine what kind of hardware you’re using

Chances are your data is stored on either a hard disk drive (HDD) or a more modern solid-state drive (SSD). The HHD is a mechanical device that stores your data by physically writing information onto a spinning disk. It uses a small mechanical part to record the data that computers understand as 1s and 0s. As a result, reading and writing data takes time and energy, so deleting files on such storage takes a less proactive approach.

After you delete files on the HHD, the files are no longer indexed, but the hard drive does nothing else to erase the files. Since the data is etched onto the magnetic disk, it remains in the same spot until a new file lands there, overwriting the old one. So, if you’re storing your data on an HDD, the likelihood of restoring deleted files is pretty high.

Now, if you’re using an SSD, restoring the data is extremely difficult. That’s because SSDs use memory cells to store data, and they have to be empty before new data can be overwritten on them. So, once a file is deleted from the Recycle Bin, your computer sends a TRIM Command to the SSD telling it that the file is no longer needed and can be cleaned from the memory cell. While this action is necessary to prevent read and write slowdown and increase the longevity of your drive, it makes it really difficult to restore data.

Deletion phase

If your file is still in the first phase of deletion (moved to the Recycle bin or Trash), it remains available on the storage drive and can be easily recovered. If your file has already passed the first phase and has been removed from the Recycle Bin before the OS overwrites or trims the data, it can be restored using modern file recovery tools. Some popular tools for that are Recuva, Disk Drill, or TestDisk, which use the following methods to recover files:

• Quick scan. The software searches the storage device for deleted file metadata, such as file name, size, type, and dates. If found it can usually recover the original file name and folder.
• Signature search. The software searches for unique headers that identify a file type (e.g., like FF D8 FF hex code for JPEG files) and carves out the full file from your storage device.

However, if data has already been overwritten or removed by SSD TRIP, the recovery becomes much harder. In particular cases, only skilled professionals, such as digital forensics experts, can recover data using advanced techniques and specialized hardware to recover small fragments that regular recovery software can’t detect.

Is it possible to permanently delete a file?

It is possible to permanently delete a file, but standard methods are not enough for that. As mentioned before, after the file is deleted, what it actually means is that the direction to the file's location gets deleted and not the file itself. So there are original bits of the file data left behind.

Even though the device sees the original file directory as empty and the new file is later created using the same space, this action only deletes the index of the original file and overwrites the 1s and 0s with the new information. While it may make the file either corrupted or permanently erased, the actual chance of the new file overwriting the original is pretty slim.

​For illustrative purposes, imagine a situation in which we delete a 10MB file from a drive with 500GB of free storage. Then, we create a new file that also takes up 10MB of space. Mathematically, the chances of the new file overwriting the data of the original file are 1 in 50,000. Yet, in real life, computers work in a more logical manner. So, the chances would be impacted by other factors, such as the type of storage. This example just shows that file deletion is not a linear process, and requires additional steps, like formatting your drive and filling it with other data multiple times to ensure the original data is 100% gone.

What kind of data do we leave behind?

A simple click of the delete button is not enough to erase your files. That’s why it’s important to take precautions to properly erase them from your device. Otherwise, a vast number of devices end up on the second-hand market, containing a ton of recoverable data.

​There have been cases in which confidential company information has been recovered from disposed of computers by people with malicious intent. That’s exactly why many companies and government agencies use a data sanitization process, ensuring data is fully deleted from computers and phones before repurposing.

​While data sanitization is being adopted rather slowly, some companies offer such services to regular consumers. This helps clear any personal data from your device before reselling or recycling your old devices.