# What happens when you delete a file and why it is rarely gone

> Deleting a file usually removes only the directory entry pointing to it, leaving the data on disk until overwritten, which makes recovery possible and secure disposal a discipline in itself.

*Section: Technology — By Amelia Hart (Technology Correspondent) — Published July 11, 2026 — 4 min read*

Canonical URL: https://dailyjunction.co.uk/technology/what-happens-when-you-delete-a-file-and-why-it-is-rarely-gone
Tags: data-storage, file-systems, privacy, data-recovery, digital-security

## Key takeaways

- File systems such as NTFS, APFS and ext4 delete by marking the file's directory entry and clusters as free, leaving the actual data intact until new writes happen to reuse that space.
- Solid-state drives behave differently: the TRIM command tells the controller which blocks are stale, so an SSD may genuinely erase deleted data within minutes, while a mechanical hard drive can retain it for years.
- The Information Commissioner's Office expects organisations to put personal data beyond use, which is why disposal regimes rely on full-disk encryption, single-pass overwriting or physical shredding rather than the Recycle Bin.

Press delete, empty the Recycle Bin, and the file looks gone. On the disk itself, almost nothing has happened. What the operating system actually removed was a signpost: the directory entry that told it where the file's contents lived and what they were called. The megabytes of data those signposts pointed to are still sitting exactly where they were, now merely labelled as space available for reuse.

That is how every mainstream file system works. Windows machines running NTFS keep a Master File Table, a catalogue with one record per file; deletion flips a flag on that record and marks the file's clusters as free in a bitmap. Apple's APFS and the ext4 system used by most Linux servers do the equivalent with their own metadata structures. The design is deliberate. Wiping the data itself would mean writing zeros over every byte of a 4GB video just to delete it, which would make emptying a bin take minutes rather than milliseconds and wear out storage for no benefit the user ever sees.

The gap between marked-as-free and actually-overwritten is where data recovery lives. Undelete tools work by reading the file system's own bookkeeping and resurrecting entries that were flagged rather than destroyed. When the bookkeeping is too damaged, recovery software falls back on carving: scanning the raw disk for recognisable signatures, such as the JPEG header bytes FF D8 FF, and reassembling files with no help from the file system at all. Professional laboratories go further still, reading platters from drives that no longer spin. For anyone who has just deleted a dissertation, this is entirely good news, with one caveat: every minute the machine keeps running, background writes may claim the freed space, so the standard advice is to stop using the drive immediately.

Solid-state drives complicate the picture in both directions. An SSD cannot overwrite a flash cell directly; it must erase a whole block first, which is slow. To manage this, modern operating systems send the drive a TRIM command on deletion, telling the controller which pages hold stale data so it can erase them in the background during garbage collection. The practical effect is that a file deleted from a TRIM-enabled SSD may be genuinely unrecoverable within minutes, whereas the same file on a mechanical hard drive could survive for years. Yet SSDs also hide data in the opposite way: their controllers keep spare, over-provisioned capacity invisible to the operating system, and remapped copies of old data can linger there beyond the reach of ordinary wiping software.

## The second-hand laptop problem

The persistence of deleted data stops being a comfort the moment hardware changes hands. Studies of second-hand drives bought on eBay have repeatedly found recoverable personal material, from tax records to company documents, on devices their previous owners believed they had cleared. Formatting rarely helps: a quick format rebuilds the file system's empty catalogue and touches almost none of the underlying data.

British organisations are not left to guess at the standard. Under UK GDPR, the Information Commissioner's Office expects personal data to be put beyond use when it is no longer needed, and the National Cyber Security Centre publishes sanitisation guidance for disposing of media. The old folk wisdom of overwriting a drive 35 times descends from Peter Gutmann's 1996 paper, written for drive technologies long obsolete; a single full overwrite is now regarded as sufficient for magnetic disks. For SSDs, where software cannot see every cell, the reliable routes are the drive's built-in secure-erase command or, better, encryption from day one: if the whole disk was encrypted with FileVault or BitLocker, destroying the key renders every block unreadable at a stroke, spare capacity included. Where the stakes justify it, firms pay for physical destruction, with shredding services reducing drives to particles a few millimetres across and issuing certificates for the audit trail.

The practical rules fall out of the mechanism. Deleted something you need? Stop writing to the drive and recovery has decent odds, better on a hard disk than an SSD. Selling or recycling a machine? Assume the bin and the format did nothing, and rely on encryption plus a proper erase instead. Deletion, as computers implement it, is a promise not to look, never a promise that there is nothing left to find.

---
Daily Junction — https://dailyjunction.co.uk/technology/what-happens-when-you-delete-a-file-and-why-it-is-rarely-gone