Why some recovery tools are still able to find deleted files after I purge Recycle Bin, defrag the disk and zero-fill free space?
Posted
by
Ivan
on Super User
See other posts from Super User
or by Ivan
Published on 2011-03-06T07:53:44Z
Indexed on
2011/03/06
8:12 UTC
Read the original article
Hit count: 242
As far as I understand, when I delete (without using Recycle Bin) a file, its record is removed from the file system table of contents (FAT/MFT/etc...) but the values of the disk sectors which were occupied by the file remain intact until these sectors are reused to write something else. When I use some sort of erased files recovery tool, it reads those sectors directly and tries to build up the original file.
In this case, what I can't understand is why recovery tools are still able to find deleted files (with reduced chance of rebuilding them though) after I defragment the drive and overwrite all the free space with zeros. Can you explain this?
I thought zero-overwritten deleted files can be only found by means of some special forensic lab magnetic scan hardware and those complex wiping algorithms (overwriting free space multiple times with random and non-random patterns) only make sense to prevent such a physical scan to succeed, but practically it seems that plain zero-fill is not enough to wipe all the tracks of deleted files. How can this be?
© Super User or respective owner