Viewing a single comment thread. View all comments

Persist_and_Resist t1_iy3hulw wrote

That is exactly yet, and that is why it can almost always be recovered up until the point in which it is written over.

101

boersc t1_iy3j0vp wrote

There is also the action of a 'destructive delete', where the file is actually overwritten with gibberish. This is done when you want to delete a file without ever being able to restore it. This could be the case when handling confidential information, or in case you plan to retire the PC and hard disk.

Basically, you're telling the system to do the 'overwriting' action immediately.

84

ElAdri1999 t1_iy48082 wrote

But if you can do the hammer delete then it's way better, since someone might be able to recover your stuff if not sufficiently deleted

23

[deleted] t1_iy4loxs wrote

[deleted]

3

CrazyMando t1_iy4nqq0 wrote

Sledgehammer

3

Pikassassin t1_iy4py1y wrote

Gigantic electromagnet

2

ElAdri1999 t1_iy4qk5j wrote

All, all is good.

My last dead HDD I removed the magnets(which are fucking strong as fuck btw) and spun the platter while scratching lines on it, when I finished I broke it just for the safety

2

Kriss3d t1_iy4tw7s wrote

If it's a 2.5" hard-drive you can just give it a good whack with a hammer.

When it sounds like a box of matches, your data is safely deleted.

4

cope413 t1_iy4tl9m wrote

Just make sure none of your crypto is on a drive you do that to.

3

yoshhash t1_iy4a8jw wrote

Isn't that the same thing as over writing with the same file name?

4

boersc t1_iy4apc9 wrote

Not perse. In that case you're erasing/reusing the ledger entry, but the 'new' file may get written on a wholly different location depending on how the OS works. But yes, it CAN work the same, if the new file overwrites the exact same spot as the old file. Most OSses work that way.

13

bob0979 t1_iy4blr4 wrote

Many drive cleaner tools will have a tool to wipe free space. They write over every bit that is not occupied with 'undeleted' data or stuff you're using. They replace everything not in use with new junk data that could just be 00000001 for every bit. This takes a fair bit of time but doing this a couple of times can remove any trace of what a specific bit says or even used to say.

If you save somethinn as 'file.name' and it's contents are 00000111 then delete it, it stays as 00000111, but if you delete it then wipe free space it changes that 00000111 to something useless.

5

Grezzo82 t1_iy5aoeu wrote

“A couple” is sometimes not enough, but a few more is considered secure enough for most contexts, though gov will often physically shred the disks to be sure.

I only know for sure with macOS, but I image isn’t this applies to all: the OS has a built in secure erase feature that will overwrite a whole disk enough times to be confident that the data is irrecoverable

1

Any-Broccoli-3911 t1_iy4fv5b wrote

No, even if it's the same filename, there's no guarantee that it will be at the same place. Also, if your new file is smaller, for example an empty file, it can only overwrite a tiny part of it if ever it's at the same place.

3

graebot t1_iy4q95g wrote

Does that work with SSDs? I thought they try to write in a new location each time to prolong life

1

Grezzo82 t1_iy5arcz wrote

SADs are much harder (perhaps impossible) to securely erase, you’re right

1

unlikemike123 OP t1_iy3i3q0 wrote

Ok, so why does my computer say that I now have more memory if it's still there? Shouldn't it technically occupy the same amount of space?

10

unlikemike123 OP t1_iy3i9q4 wrote

O wait, that space is now available to be taken over by new data?

51

Hyperspacehost t1_iy3wgqy wrote

It’s worth thinking of computer memory less like a resource that’s used up, like water being scooped out of a bucket and drank, and more like sand in a sandbox.

Sometimes it’s being used for something meaningful, like being a castle or making the walls of a big hole or having letters written in it, and sometimes it just lying around doing nothing, but there’s not any more or less of it.

You might draw a line around a bit and say, “my castle is here, don’t use anything inside the line”, and at the end of the day you rub the line out and go, “I’m all done now, so do whatever”. Maybe you come back and the castle is still there or maybe someone has knocked it down and built something else with it.

24

Neuro0Cancer t1_iy3iplc wrote

Exactly. The "free" memory is just the available memory, not the empty memory.
In fact memory that has been overwritten can still be recovered.
That's why there is software that "clean" your disk if you want, and it takes a while because basically what it does is just overwrite over and over again the disk until recovery is almost undoable.

14

[deleted] t1_iy41j00 wrote

[deleted]

0

AdmirableOstrich t1_iy470c2 wrote

There isn't really (official) publicly available software to do this, but depending on the storage technology you can often tell not only the current binary state of a memory bit but also the previous one.

As an example, we might say a bit is on if it is at 5V and off at 0V. However, real bits have voltages that vary quite a bit and we just threshold at (say) 2.5V. The actual voltages depend on (among other things) the previous state of the bit. If AB denotes a previous state A and a current state B, you might have something like:

00 -> 0.5V 10 -> 0.9V 01 -> 4.1V 11 -> 4.5V

Note that is doesn't quite work like this. The main point is that with dedicated hardware you can try to read data that has been lightly overwritten. This is why tools intended to purge data will overwrite many times with random bit sequences to minimize the chance of data recovery.

7

Alternative_Log3012 t1_iy4kkgi wrote

You won’t be able to do these sort of voltage reads in the standard OS the computer is running. I’m assuming you will need to remove the drive and put it into dedicated forensic recovery hardware. This could be even more difficult if your SSDs are soldered on like it most modern ultra books.

1

tim36272 t1_iy439pq wrote

Programs like Recuva do it for you. In the basic mode it is just reading all the entries that are marked as deleted.

2

dale_glass t1_iy3ircn wrote

Yup.

Also, fun fact, computers lie to users all the time. Eg, say you're playing a game and save. The game with very high likelihood will tell you it has saved well before the computer actually did it, and resume playing.

Why? Because people hate waiting, and the computer can actually do the writing to disk while you keep playing without making you wait for everything to be done.

There's many, many such optimizations.

8

ThatGenericName2 t1_iy3vbv5 wrote

There's also the lie in the other direction. While I don't think it's practiced anymore, sometimes software would "fake load" in that the program simply just waits for an extra bit of time because people would think that a computer didn't do something properly if it worked too fast.

4

goclimbarock007 t1_iy41vuk wrote

I read an anecdote about a programmer that wrote some sort of script that worked too fast and didn't look like it actually did anything. He added sleep counters and a progress bar to make it seem like it was doing something. A year later he "optimized" the program by cutting the sleep timers in half.

7

ClownfishSoup t1_iy4mkcj wrote

This weird thing happens with cake and cookie mixes as well. You can easily make a mix that just requires adding water and then baking, but people didn't believe they would be any good, so manufacturers changed the ingredients so that the end user has to add oil, milk and eggs to the mix. ie; people were suspicious that the mix was too easy, so they dumbed it down.

2

Brian57831 t1_iy41vtz wrote

Until you crash shortly after saving and the file shows it's corrupted.

1

DeHackEd t1_iy3mcrz wrote

People often ask why deleting files is faster than creating files. The answer is because the bulk of the file's data is NOT erased, because that's considered wasted effort. When the new file comes along it will write over the data, completely unaware of what was once there. So actually blanking out the old data doesn't really accomplish anything and the "delete" is really fast by just dealing with the file listing paperwork.

...unless there's privacy concerns that warrant actually clearing the data, specifically because preventing undelete from being possible is the goal. This is sometimes called "secure delete". But if you're uninstalling a video game, who cares?

4

EcchiOli t1_iy3oori wrote

Mostly useless remark, quoting you,

> People often ask why deleting files is faster than creating files

That's the case for the most common operating systems. However, sometimes, with server hardware + software, it's working differently and deletion can take a long time, as with linux's ext4. It's still relatively fast, but much slower than the others nonetheless.

0

kucksdorfs t1_iy3uze3 wrote

Think of it as a table of content in a book. So when you "delete' a file, you just remove the table of content chapter marker, but not the pages. Then, when you need to write more data, you "write" to the pages then update the table of content.

Things can get more complicated when it comes to flash storage (ssd/flash drive) but only when it comes to overwriting the pages.

2

eotty t1_iy45ump wrote

Imagine a binder with a table of contents, inside the binder there are pages, when deleting a file you just erase the page number, the page is still in the binder but you no longer know where to look. (If you want to find the pages again, there is special software, akin to looking through the binder page by page)

Some documents are several pages long, so when you later write something to the binder and replaces the pages, you might have page 4,7,9 of your document left, thats when it cannot be recovered anymore.

1

Defleurville t1_iy3lxmr wrote

Just to clear up any confusion, the word memory is often used in confusing ways. Expensive working memory (RAM) is used to do stuff (like a kitchen counter), whereas cheaper storage memory (SSD, HDD) is used to keep stuff (like kitchen cabinets).

Current computers have working memory in the 16GB to 128GB range and storage memory in the hundreds to thousand of gigabytes (known as terabytes)

Phones and tablets (and video game consoles) all have working memory, but the numbers are basically unadvertised (~up to 4 GB). Their storage memory is widely advertised, but is often in the same 16-128GB range as a computer’s working memory, which adds to the confusion.

While technically these are all “memory”, when we speak of a computer’s memory, we usually mean working memory (RAM) — not the one freed up by deleting files. But when we speak of a phone’s memory, we usually mean storage memory (SSD)

7

Any-Broccoli-3911 t1_iy4gc16 wrote

Your free memory is the memory your computer is allowed to use, which includes any deleted files even if it's still there. Your computer doesn't care about the information in the free memory, but it's recoverable.

1

21_MushroomCupcakes t1_iy4olnj wrote

Stuff that's "marked for overwrite" isn't counted against total capacity.

I would just like to make the distinction that memory and storage are not the same thing, memory is your RAM and storage is your hard drive.

Many people are using them interchangeably, which will run aground if memory addresses ever come up.

1

clideb50 t1_iy4ece7 wrote

It’s also why it’s good practice to pull the drive out of the computer when throwing it away/recycling it, and then destroying the drive.

1