What deletion actually does
On a conventional file system, a file is described by metadata: a directory entry and a record that points to the blocks holding its content. Ordinary deletion removes or marks that record and returns the blocks to the free list. The blocks themselves are not touched, so the content survives intact as data remanence until the file system assigns that space to something else. On a lightly used volume this may never happen. On a busy one it can happen within minutes. So “deleted” describes whether the file is visible, not whether its data is still there.
Stages of deletion
Only the last stage, purge, destroys the data in any meaningful sense, and only that stage can be documented as destruction.
- 1
Recycle bin
The file is moved, not deleted. It stays listed and can be restored.
- 2
Emptied bin
The directory entry is removed. The content remains as unallocated space.
- 3
Overwritten
New data is written over some or all of the original blocks. Recovery becomes partial, then impossible.
- 4
Securely erased
The content is destroyed on purpose: by overwriting, by cryptographic erasure of its key, or by the device’s sanitize command.
How recovery works
Content outlives its metadata. Recovery tools scan unallocated space for recognizable structures, such as file signatures, headers, and known layouts. They rebuild files without any directory information, a technique called file carving. Forensic investigators rely on it, and deleted documents, message fragments, and images are routine findings. The same property makes casual deletion an inadequate control when a device leaves the organization, which is a common route to data theft.
Where copies persist
A securely erased file can still survive elsewhere, because modern systems copy content automatically, often through a backup or sync service. Effective deletion starts with an inventory: find where the data exists, not just how to delete one instance of it.
| Copy type | What persists |
|---|---|
| Backups and snapshots | Copies made before deletion, often held under retention rules |
| Version history | Earlier versions kept by file systems, document platforms, and cloud storage |
| Synchronization | Copies on other devices and cloud accounts, each deleted differently |
| Caches and previews | Thumbnails, autosave files, and index entries holding extracted content |
| Spool and journal data | Print queues, database logs, and file-system journals that recorded the content |
Why flash storage is different
On flash storage (SSDs, eMMC, memory cards), the controller decides internally where data is placed, using wear leveling and over-provisioning. An overwrite from the operating system may therefore miss the cells that held the original data, so overwriting sector by sector is unreliable on these media. The accepted options are the device’s own sanitize or secure erase command, or cryptographic erasure. Cryptographic erasure encrypts the medium from the start and destroys the key, which makes all remaining ciphertext unusable in one step. Physical destruction is the final option for media that cannot be verified or trusted.
Deletion as an obligation
Data protection frameworks require that data not be kept longer than necessary. The GDPR gives individuals a right to erasure in defined circumstances. Retention schedules, verifiable erasure procedures, and records of media disposal help organizations meet these duties. Decommissioned laptops, drives, and phones must also not leave the organization still holding recoverable records.
A delete command removes only a pointer. Only documented destruction removes the data.
Anexet Team