Erasing Data

When Is Data Actually Erased?

In your OS, there is a place to put files you want to erase. In Windows, it's the "Recycle Bin" on the Desktop. In the Mac OS, it's the "Trash," located in the Dock. For convenience, let's use the term "Trash," as it's shorter.

These trash containers are actually just a kind of folder or directory; you can drop icons into them, and you can take the icons out as well. When the trash is empty, the icon appears empty; when you put something into the trash, it appears to be filled with crumpled-up papers.

When you wish to empty the trash, you can do so usually by right-clicking on the icon and choosing "empty" from the pop-up menu. Usually, you will get a warning dialog asking you if you are sure you want to delete these files (you can turn off these warnings if they annoy you). When you indicate that you indeed want the files deleted, there will be a little animation and/or sound effect, and the trash will then appear to be empty, and your files gone.

However, when you empty your trash, the files are not actually deleted! Think about it for a moment: let's say that you have a 2GB video file. It took perhaps 90 seconds or so to write onto the disk. But when you delete it, it only takes less than a second, and it's gone. That's not right--if it takes 90 seconds to write, it should take 90 seconds to delete.

Here's another thing to consider: when you do a search for a file or for data, it doesn't take very long (depedning on which OS version you are using). At most, it takes a few minutes. However, it would take hours for your computer to actually look at every piece of data. So, how does it find files and data so quickly?

Here's how it works. On your hard disk drive, there is a file system directory--actually, a list of files on your computer, with notes on where the data is located on your disk. Think of it as being like a building directory. If you visit a 40-storey office building an need to find somebody, do you look in each office on every floor? Of course not. Instead, you look at the "directory"--a list of names on the ground floor, which tell you the location of every office. This is much faster! Also, keep in mind that if you were to remove the name of a person on the list, that person would not immediately disappear just because you removed the listing.

A computer's file listing works the same way. Data is stored on the disk, but there is a file directory which keeps track of the location of every piece of data. Here's the important part: when you "empty" the trash and "delete" the files, you are only deleting the directory listing; the actual data remains in place. That's why it is so quick!

Before erasing; the data exists on the disk, and the location is noted in the directory

After "erasing"; the data still exists on the disk; the location is only deleted in the directory

Data Recovery

So, is it easy to get the data back? Sadly, no. Because the computer has lost the listing, it cannot find the data any more. You must use special "data recovery" software which will look at every little bit of data on the disk and try to guess which parts are "erased" files. You can get the data back, but it takes a long time and is troublesome. However, the data is still there.

So when does the data really get erased? Well, after you delete the file listing in the directory, the computer treats that area as if it were blank. When you save new files, the computer will use that "blank" space, over-writing the previous data. It does not take long for enough sata to be over-written before the "erased" file is too damaged to recover fully. However, it usually takes a while before all the old data is completely over-written.

Why Is This Important?

Let's say you want to sell your computer, or give it to someone. You take all your files, throw them into the trash, and empty it. You think that your files are gone--but if the person who gets the computer wants to, they can still recover most of your data--including very private information!

If you use an OS install disk, it allows you to formatThis means to "clear" the disk and make it ready for new data. the drive. There are usually options to do it "fast" or "slow." If you do it the fast way, then again, you are not erasing data. Instead, you are just erasing the whole directory and creating a new, empty one.

In order to actually, fully erase something, you must Zero OutThis means to replace all of the data with only zeroes. the data. This is often called Secure Erase, as it protects your privacy.

On the Mac OS, these tools are built-in. If you wish to empty the trash, for example, the "Finder" (Desktop) menu gives you the option to simply "Empty Trash," which is the directory wipe, or to "Secure Empty Trash," which zeroes out the files which are currently in the trash. This can be done in Windows, but you need to download special software for it.

Alternately, when you wish to erase the entire disk, you would use the OS install disk, which includes disk utilities. This will give you the option of doing a disk format which zeroes out all the data on the drive--but it takes a long time to do so.

How Many Times Do I Need to Overwrite?

Most secure erase systems give you the option of overwriting the data multiple times; as you can see from the Mac Disk Utility shown here, you can opt to zero out the data once, 7 times, or 35 times.

Which one do you need? It is often thought that at least 7 passes are necessary for the data to be wiped clean, but this is not true unless you are using old hardware. Before 2001, hard disk data writing was less "clean," and each bit of data "spilled" out around the edges of its space on the disk. Erasing data sometimes did not include all the "spilled" data, and so even after a single zeroing out, the data could still be read. Therefore, multiple passes were required.

However, hard drive made after 2001 do not have this problem, and only a single pass at zeroing out data is necessary.