How to Properly Delete Stuff

Most people think deleting a file means it’s gone forever. You select a file, hit Delete, empty the recycle bin, and move on with your life assuming the data no longer exists.

That assumption is one of the biggest misconceptions in computing.

In reality, deleting a file usually does not erase the data. It only removes the operating system’s reference to it. The data itself often remains on the storage device until it is overwritten by something else.

This article breaks down:

• What actually happens when you delete a file
• Why deleted data can often be recovered
• The difference between logical deletion and physical destruction
• How operating systems manage storage internally
• What “proper deletion” really means
• How overwriting works in practice

The Illusion of Deletion

When you delete a file, your computer is not immediately scrambling bits or erasing sectors. That would be slow, inefficient, and unnecessary for everyday use.

Instead, operating systems prioritize speed and convenience.

Deletion is designed to be fast, not secure.

At a high level, deleting a file means:

• Removing the file’s entry from the file system index
• Marking its occupied disk space as “free”
• Leaving the actual data untouched

The operating system simply says:

“This space can be reused in the future.”

Until that happens, the data stays right where it was.

Understanding File Systems and Indexing

To understand deletion, you need to understand how file systems work.

File systems like NTFS, EXT4, or APFS don’t constantly scan the disk to find files. Instead, they rely on metadata:

• File names
• File sizes
• File locations
• Permissions
• Timestamps

All of this information lives in special structures (like the Master File Table in NTFS).

When you delete a file:

• The metadata entry is removed or flagged as unused
• The pointer to the file’s disk blocks is discarded
• The disk blocks themselves are untouched

So the data still exists — the system just no longer knows where it is.

A Simple Analogy: The Library Problem

Imagine a massive library.

• The books represent raw data on disk
• The catalog represents the file system index

Deleting a file is like removing a book’s catalog card.

The book is still on the shelf.

The librarian just doesn’t know where it is anymore.

Recovery tools work by ignoring the catalog and scanning the shelves directly.

Why Deleted Data Is Recoverable

Because deleted data is still physically present, recovery software can:

• Scan raw disk sectors
• Identify known file signatures (PDFs, images, videos, etc.)
• Reconstruct files even without file names

This is why:

• Accidentally deleted photos can be restored
• Used hard drives can leak sensitive data
• Formatting a drive doesn’t guarantee data removal

From the user’s perspective, the file is gone.

From the hardware’s perspective, nothing changed.

Quick Deletion vs Permanent Deletion

There are multiple layers of “deletion”:

Recycle Bin / Trash

• File is moved, not deleted
• Easy to restore

Emptying the Recycle Bin

• File system reference removed
• Data still exists

Formatting a Drive

• Index structures recreated
• Data still exists

Overwriting Data

• Actual disk sectors replaced
• Recovery becomes impractical

Only the last one truly destroys data.

Logical Deletion vs Physical Destruction

This distinction is critical.

Logical Deletion

• Removes references
• Fast
• Reversible
• Default OS behavior

Physical Destruction

• Overwrites or destroys data
• Slower
• Irreversible
• Requires explicit action

Most users only ever perform logical deletion.

What Proper Deletion Actually Means

Proper deletion means ensuring that previously used disk space is overwritten so old data cannot be recovered.

This does not mean deleting files again.

It means writing new data on top of where the old data used to be.

Overwriting replaces old bits with new ones:

• Zeros
• Random patterns
• Pseudorandom data

Once overwritten, recovery becomes extremely difficult, this could be a possible solution.

Why Operating Systems Don’t Do This by Default

Secure deletion is intentionally not the default because:

• Overwriting is slow
• It increases disk wear
• Most users don’t need it
• It wastes system resources

Operating systems optimize for performance, not forensics resistance.

Security-conscious deletion is considered a specialized operation.

Overwriting Free Space Instead of Files

Instead of targeting individual files, a common strategy is:

Overwrite free space on the disk.

This ensures that:

• Any remnants of deleted files are replaced
• Existing files remain untouched
• The process is safer and simpler

Windows provides a built-in tool for this: cipher.

Example: Securely Overwriting Deleted Data

Below is a Python script that automates this process on Windows.

import os  
import subprocess  
import time  

def wipe\_drive(drive\_letter, iterations):  
    drive\_letter = drive\_letter.upper()  
    # Safety checks  
    if drive\_letter == "C":  
        print("ERROR: You cannot wipe the system drive (C:).")  
        return  
    if len(drive\_letter) != 1 or not drive\_letter.isalpha():  
        print("ERROR: Invalid drive letter.")  
        return  
    full\_path = f"{drive\_letter}:"  
    print(f"\\nWARNING: This will overwrite deleted data on drive {full\_path}.")  
    confirm = input("Type YES to continue: ")  
    if confirm != "YES":  
        print("Cancelled.")  
        return  
    for i in range(1, iterations + 1):  
        print(f"\\n=== Pass {i}/{iterations} ===")  
        print(f"Running: cipher /w:{full\_path}")  
        try:  
            subprocess.run(\["cipher", f"/w:{full\_path}"\], check=True)  
            print(f"Pass {i} completed successfully.")  
        except subprocess.CalledProcessError:  
            print("Error running cipher. Are you running as ADMIN?")  
            return  
        time.sleep(2)  
    print("\\nAll passes completed. Deleted data is overwritten.")  
\# ---- Main Program ----  
drive = input("Enter the drive letter to wipe (example: E): ").strip()  
passes = int(input("How many wipe passes do you want? "))  
wipe\_drive(drive, passes)

What This Script Actually Does

• It does not touch existing files
• It overwrites all free space on the selected drive
• It replaces leftover deleted data with new patterns
• Multiple passes reduce recoverability even further

This mirrors how professional disk sanitization tools work internally.

Why Multiple Overwrite Passes Exist

Older magnetic drives had subtle physical artifacts that could theoretically be analyzed to recover previous data states.

Multiple overwrite passes were designed to eliminate this risk.

On modern drives:

• One pass is usually sufficient
• Multiple passes add psychological and procedural assurance

Security is about risk reduction, not absolute guarantees.

HDDs vs SSDs: An Important Difference

Secure deletion behaves differently depending on storage type.

Hard Disk Drives (HDDs)

• Data is overwritten directly
• Tools like cipher work well
• Multiple passes make sense

Solid State Drives (SSDs)

• Wear leveling moves data internally
• Overwriting specific sectors is unreliable
• Secure erase requires firmware-level commands

This means that file-based overwriting is less reliable on SSDs.

For SSDs, full-disk encryption + key destruction is often the best solution.

Why This Matters More Than People Think

Improper deletion can lead to:

• Privacy leaks
• Data recovery from sold drives
• Corporate data exposure
• Legal and compliance issues

Many real-world data breaches happen not through hacking, but through improper disposal.

Common Myths About Deletion

• “Emptying the recycle bin deletes everything” → ❌
• “Formatting a drive wipes it” → ❌
• “Deleted means unrecoverable” → ❌
• “I overwrote the file once, so it’s gone” → ❌

Deletion without overwriting is just forgetting, not destroying.

Final Thought

Deleting files makes data invisible, not nonexistent.

The file system stops pointing to the data, but the data itself remains until something else replaces it.

True deletion requires intention:

• Understanding how storage works
• Knowing the difference between logical and physical removal
• Taking explicit steps to overwrite old data

Deletion is fast.

Destruction is deliberate.

And knowing the difference matters more than most people realize.