Are deleted files permanently gone on HDD/SSDs and USB drives?

Questions
1

hi everyone,

I have a question about file deletion on Windows/Linux/Mac/iOS, specifically regarding HDD/SSDs and USB drives. When I delete files (like documents or .exe files) and then empty the Recycle Bin, are those files permanently deleted, or is there a chance they can still be recovered?

if yes, do I need to follow a weekly routine and use, for example, Eraser (the program) to delete all unused space (by using drive erasure method Pseudorandom data)? Should I also use it on every USB drive that I have, especially those that donā€™t have encryption and a password (If a person use them to share content from encrypted devices)? Or itā€™s just 'if the government (my threat) enter in your smartphone youā€™re already screwed so using Eraser or not I would change much? (that comment wouldnt count for the usb drives though) any insights or experiences would be greatly appreciated

thanks

2

No , those file are not be permanently deleted. Usually on deleting files your system just forgets path to that stored data. So told like testdisk can find and recover this data, unless such space hasnā€™t been overwritten by other data.
So if you feel you donā€™t want people to be able to recover your data, you should use Disk encryption on your OS as mentioned on PG recommendation page Recommended Encryption Software: VeraCrypt, Cryptomator, PicoCrypt, and OpenPGP - Privacy Guides.

Also keep a good user password to access your machine. If you have a good password
i donā€™t think you need to delete things on drive everytime. unless its a public computer. Then i would suggest not store any sensitive data on it at all, Or just create a separate user profile and encrypt home directory if on linux

Also refer to this thread of mine for secure data erase ShredOS and other Disk erase tools

I am not sure about the USB drive part. You can use a veracrypt container to store sensitive files on it.

Also in case of a threat from state actor secure data erase may not be sufficient to prevent advanced recovery tools in recovering your data, still disk encryption should help a lot.

3 Likes
3

No

2 Likes
5

That really depends who your authorities give the drives to and how much time and money they are willing to spend.

If you think that you are that important that money is not an issue thereā€™s only one way to be 100% sure and that is physical destruction of the drives, e.g. by shredding them into small particles.

1 Like
6

Iā€™m learning something here, but just want to validate, formatting a disk is not enough?

7

Nope. It really doesnā€™t help.

2 Likes
8

When you delete files from your system and empty the Recycle Bin (or Trash on macOS), Windows/Linux/macOS marks the space as ā€œfreeā€ for future data storage, but the actual data remains on the drive until it is overwritten by new data.

Blockquote
Iā€™m learning something here, but just want to validate, formatting a disk is not enough?

Formatting a disk also does not erase the data, as it only removes the file system index, making the files invisible to the operating system and regular users.

This means that data recovery tools can potentially recover these files, especially if the data hasnā€™t been overwritten yet.

Tools like Eraser, nwipe (for Linux), and many other third-party data-wiping software can help securely delete files by overwriting free space with pseudorandom data.
For more details, check these resources:

This is especially important for mechanical HDDs and SSDs. If your USB drives lack encryption or password protection, take extra steps to ensure data safety. If youā€™re using a mechanical (traditional) HDD or SSD, this is especially useful. If your USB drives donā€™t have encryption or password protection, you should take extra steps to ensure data safety.

2 Likes
9

I was surprised to read ā€œFormatting a disk also does not erase the data,ā€ and then I read the remaining part of the sentence. On some systems that do formatting there is a quick format and a full format, and I believe (but I may be wrong) the full format overwrites all data; at least at the logical level.

Still, overwritten data can be physically recovered with specialized equipment and techniques depending on the medium type.

Encrypting all data is highly recommended. It reduces the risk of data compromise in the event of loss or theft. Or medium failure. A few times I had warranty for faulty USB drives but could not avail it because it required returning the faulty USB drives back to the retailer, and I had used plaintext FAT filesystems that I could no longer overwrite :person_facepalming:

10

On HDD/USB you should use shred (unix)/eraser (windows).

On SSD shred/eraser is snake oil: https://unix.stackexchange.com/questions/593181/is-shred-bad-for-erasing-ssds

TL;DR: enable periodic fstrim on SSD and donā€™t bother. If you need to wipe the
disk clean, do so via diskā€™s controller. On linux you can send such a
command via ā€˜nvme format --force --reset --ses=1 /path/to/diskā€™

11

Data sanitization is one of the topics Iā€™d like to have a systematic and comprehensive guide for since it is very difficult to achieve and verify properly.

There are many things to consider including, but not limited to, your specific threat model(more specifically, the amount of resources and technology your adversary is capable of utilizing and the expected value of your data when recovered), the type of your storage media (SSD, HDD, USB, CD/DVD, paper, etc), and the degree of sanitization (clear, purge, destroy).

One of the best references in data sanitization is the NIST SP(special publication) 800-88 Revision 1.
IEEE also published a more recent standard for storage sanitization(IEEE 2883-2022) with related draft recommendations. I strongly recommend that anyone who plans to perform a proper data sanitization go through the two papers above.

Also, the VeraCrypt official documentation has some pretty practical information regarding difficulties and caveats of data sanitization(TRIM, wear-leveling, reallocated sectors).

Encryption(especially full-disk encryption) greatly helps data sanitization through a method named cryptoshredding(=cryptographic erasure).

A simple format of a disk drive can neither sanitize data nor protect a disk from forensics, since it simply *marks* the disk as empty, while leaving the actual data in place.
One easy way to overcome this issue is to perform a low level format which overwrites the whole disk with zeroes(binary bit 0).
However, due to the variety of manufacturing vendors and many ancillary technologies implemented and hardwired into the device to prevent data loss (e.g., overprovisioning space, wear-leveling, TRIM, reallocated sectors), this method many not completely overwrite all sectors fully.

AFAIK, there is no single-best universal option that could be applied to all devices. Instead, you should extensively search for the method that best suits your very specific situation.
If youā€™re okay with closed-source softwares, the built-in sanitization tool of your BIOS, or the manufacturerā€™s management tool(e.g., Samsung Magician, SK Hynix Drive Manager, Western Digital Drive Utilities) is a good option, although they still might not be perfect due to inappropriate implementation of technologies (pretty sure I saw an article regarding this, but canā€™t find the exact source. please let me know if you find any).

The best open-source tool for data sanitization Iā€™m currently aware of is ShredOS. Although it has some compatibility issues, it uses official commands that are documented in the specifications of the hardware (such as ATA secure erase, NVMe-sanitize, etc).
Additionally, Linux users can directly issue a sanitize command to their NVMe using the NVME-cli

Data sanitization is extremely difficult to achieve perfectly unless you physically destroy the device (which renders the storage media unavailable for reuse).
However, unless your threat model is a nation-wide actor that is capable of utilizing state of the art technologies with nearly infinite resources and time, I believe a single or twice low-level format, or a simple format of a VeraCrypt-encrypted disk is more than sufficient for most people.

In short, if you need absolute data sanitization, throw it into a blast furnace.
Otherwise, just do a clean all on cmd(or maybe SDelete, Cipher.exe?)

1 Like