Deletion vs Erasure
Definition
Deletion marks the file entry as free; content blocks remain until overwritten. Erasure (shred, sdelete, secure-erase) overwrites the blocks before unlinking. The difference is the recovery probability.
- Deletion effect
- File entry marked free, data blocks remain
- Erasure effect
- Data blocks overwritten before unlinking
- Practical difference
- Recovery probability
Common questions
Why can a deleted file often be recovered by a forensic examiner?+
Deletion only removes the file system's pointer to the data and marks the space reusable; the actual content blocks stay on disk until new data happens to overwrite them, so recovery tools can often reconstruct the file.
Does running a secure-erase tool guarantee data is unrecoverable?+
It greatly reduces recovery odds by overwriting the blocks, but effectiveness depends on the storage medium; on SSDs, wear-levelling and remapped blocks can leave residual copies that a single-pass overwrite does not reach.
Related terms
- BitLocker
- Microsoft's full-volume encryption on Windows. Volume Master Key wrapped under TPM, password, recovery key (48 digits), or AD/MBAM/Intune escrow. Hashcat mode -m...
- File Carving
- Recovery technique that scans raw disk blocks for known file headers and footers, ignoring filesystem metadata. The only option when the filesystem...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...
- VeraCrypt Hidden Volume
- A second, encrypted volume nested inside the free space of a primary VeraCrypt volume. Either password unlocks one of the two volumes;...