Viewing a single comment thread. View all comments

Neuro0Cancer t1_iy3iplc wrote

Reply to comment by unlikemike123 in eli5 How is computer memory deleted? by unlikemike123

Exactly. The "free" memory is just the available memory, not the empty memory.
In fact memory that has been overwritten can still be recovered.
That's why there is software that "clean" your disk if you want, and it takes a while because basically what it does is just overwrite over and over again the disk until recovery is almost undoable.

14

[deleted] t1_iy41j00 wrote

[deleted]

0

AdmirableOstrich t1_iy470c2 wrote

There isn't really (official) publicly available software to do this, but depending on the storage technology you can often tell not only the current binary state of a memory bit but also the previous one.

As an example, we might say a bit is on if it is at 5V and off at 0V. However, real bits have voltages that vary quite a bit and we just threshold at (say) 2.5V. The actual voltages depend on (among other things) the previous state of the bit. If AB denotes a previous state A and a current state B, you might have something like:

00 -> 0.5V 10 -> 0.9V 01 -> 4.1V 11 -> 4.5V

Note that is doesn't quite work like this. The main point is that with dedicated hardware you can try to read data that has been lightly overwritten. This is why tools intended to purge data will overwrite many times with random bit sequences to minimize the chance of data recovery.

7

Alternative_Log3012 t1_iy4kkgi wrote

You won’t be able to do these sort of voltage reads in the standard OS the computer is running. I’m assuming you will need to remove the drive and put it into dedicated forensic recovery hardware. This could be even more difficult if your SSDs are soldered on like it most modern ultra books.

1

tim36272 t1_iy439pq wrote

Programs like Recuva do it for you. In the basic mode it is just reading all the entries that are marked as deleted.

2