"The best safety lies in fear."
William Shakespeare
You might expect that Windows would go to the container and erase the data, then remove the reference from the table. Nope. What windows does is simply removes the reference to the file in the table. The actual data is left on the drive.
In figure 2, notice that container 2 and container 3 are both marked “available” in the File Allocation table, but the data that had been saved to the hard drive is still there. This data will remain on your hard drive until Windows requires the space for another file.
|
File |
Container # |
Hard drive |
|
File1 |
1 |
1011100101 |
|
Available |
2 |
0101011010 |
|
Available |
3 |
1010111101 |
|
File3 |
4 |
1110001010 |
Fig. 2
When Windows is requested to save another file, it will then overwrite the data and make a new entry in the FAT. If the new file is smaller than the file that has been deleted and takes up less containers than the original file, then a part of your original file will remain on the drive until Windows need that space. Fig. 3 demonstrates how this works.
|
File |
Container # |
Hard drive |
|
File1 |
1 |
1011100101 |
|
File4 |
2 |
1100111010 |
|
Available |
3 |
1010111101 |
|
File3 |
4 |
1110001010 |
Fig. 3.
In addition to an unused container holding information from the undeleted files, there is another area of concern. This is the unused portion of a container, called the slack portion of a file. The slack portion of a file is located at the end of a file when the file does not completely fill up the space in a container. It is the space left over in the container. The slack portion of a file can contain fragments of a previous file or files that had been written there. If this isn’t bad enough, it could contain random bits of information from your memory as well. This information could be anything from senseless garbage to your bank account number or password information.
You can now see how your deleted files can remain vulnerable to unwanted access. Even after deletion, your files could remain on your hard drive in part or in whole, until Windows saves another file over top of it.
Once Windows has overwritten your deleted file, you’d think that would be the end of it, right? Um . . . . not quite.
Continue... 
E-mail this article
All articles are owned and copyright of DarkStone Data. Reproduction in part or in whole is strictly forbidden without the expressed written permission of DarkStone Data
