Secure deletion: what 'delete' actually does to a file

Deleting a file feels final. You drag it to the trash, empty the trash, and it is gone. In reality, "delete" is a request to the computer to stop treating that space as occupied. Whether the contents are really unrecoverable depends on the device, the settings, and the other places a copy may have landed. This article is general technical education; exact behavior differs between products and versions, so treat the points below as how to think about it, not as promises about any one device.

Layer one: the recycle bin

The recycle bin (or trash) is not deletion. It is a holding area. The file is moved, not erased, and anyone with access to the account can open the bin and restore it. Emptying the bin is the first real step, but it only unlinks the file from its folder. That brings us to the next layer.

Things to remember here: each user account has its own bin, external drives often have their own hidden bin, and shared network folders may or may not have one at all. A file you "deleted" last month may still be in a bin you have never looked at.

Layer two: what the file system does

When a file is deleted from a conventional hard disk, the file system generally marks the space as free and removes the directory entry. The actual data often stays where it was until something else is written over it. That is why recovery tools can sometimes bring back deleted files. On a busy disk, new data may overwrite the old over time, but you cannot count on a particular file being overwritten by a particular date.

This is the origin of "secure delete" and "shredder" tools, which write patterns over a file's space before releasing it. On a traditional spinning disk, that approach can be reasonable for individual files, though it only covers the copy the tool knows about. It does not reach copies in backups, sync folders, or temporary files that programs made along the way.

Layer three: SSDs and why overwriting behaves differently

Solid-state drives and flash storage do not work like spinning disks. They spread writes around internally to extend their life, and they manage their own mapping between what the operating system thinks is a location and where the data physically sits. So when an overwrite tool writes new data to "the same place," the drive may quietly write it to a different physical spot and leave the old cells untouched until the drive decides to clean them up. Many drives also support a trim command that tells the drive which space is free, but when and how the cleanup happens is up to the drive.

The practical conclusion is modest: file-level overwrite tools are less dependable on SSDs than they were on older disks, and you should not assume they worked just because the tool reported success. This is a good reason to stop relying on file-by-file shredding as your main plan.

The practical answer: encrypt the whole disk from day one

If the whole disk is encrypted with full-disk encryption (BitLocker on supported Windows editions, or LUKS on Linux, for example), then everything written to it, including deleted-but-not-overwritten leftovers, is stored in encrypted form. At the end of the device's life, the plan becomes simpler: make sure the recovery keys are no longer needed, remove or destroy the key material, then perform the manufacturer's reset or secure-erase procedure and, for anything that held client data and is leaving your control, consider physical destruction by a vendor who provides a certificate. Your IT provider can tell you which of these fits your hardware.

Be careful about the limits of this advice. Encryption works best when it is on before client data is written (if you turn it on later, choose the option that encrypts the whole drive), if the recovery key is stored somewhere safe, and if the machine is powered off or locked when it is lost. It does not clean up copies elsewhere. It is the best default for protecting lost or retired devices, not a complete deletion method.

Layer four: cloud sync copies and version history

Sync services such as OneDrive and Google Drive keep their own bins and, often, older versions of files. Deleting a file from a synced folder on one computer typically deletes it in the cloud and on other synced devices, but it may sit in the service's trash for a while and earlier versions may remain available. Shared folders add another wrinkle: a copy might also exist in a colleague's synced folder or in a link you shared long ago.

Check the web interface of each service for its trash and its version history, and review who the file was shared with. Your administrator can tell you what retention settings are in force for your account.

Layer five: backups

A backup is a deliberate copy, so deleting the original does nothing to it. Files you removed from a laptop may remain in last night's backup, last month's backup, and the external drive in the closet. Deleting something "for good" therefore means deciding how long backups are kept and what happens when they age out. Make sure your backup rotation expires old copies on a schedule that matches your retention schedule; see USB drives and old backups for a practical routine.

A disposal checklist

1. Decide the file really is past its retention period (check your written schedule first).
2. Delete it from the working location and empty that account's recycle bin.
3. Check the cloud service's trash and version history, and any shared copies.
4. Look for copies in Downloads, email attachments, scan folders, and USB drives.
5. Note which backups still contain it and when they expire.
6. For retired devices: confirm full-disk encryption was on, retire the keys, reset or erase the device, and use a destruction vendor for anything you cannot verify.
7. Write down what you did, who did it, and the date.

MyVaultMate helps you find files with sensitive data in the places that tend to be forgotten, but it moves or deletes nothing on its own; removal is yours or your IT provider's job. You can see a sample report at /sample.