Day 13 - May 13 - Deleted does not mean gone forever
- Elizabeth Rasnick
- May 13, 2023
- 2 min read
It’s Saturday! We got up early and went yard saling. As we browsed through all the items spread out on tables on tarps on the ground, I noticed some electronics that have memory chips in them. It made me wonder: did these people completely wipe the memory before they decided to sell this? Here’s what made me wonder.
When you delete a file on your computer, the bits that make up that file are not deleted. Instead what happens is that the access to the file is removed. The mechanism that does this varies based on the operating system, but the effect is the same. What this means is that the file itself is still intact, but the index (registry) of files lists the deleted file’s location as available for use.
If a new file comes along to be saved and the registry needs this recently available space, it will write the new file’s data over the old file’s. In other words, until the old file’s space is not needed, that data is still recoverable.
When someone deletes their files and then sells their device, the new owner may be able to reconstruct the deleted files. Even if new files have been written over earlier files, the back-ups of the deleted files can be retrieved. From the back-ups, the original files can be restored. At this point I’ll introduce the idea of file fragmentation. Sometimes a file is saved in pieces (fragments) instead of one continuous block. Your device's settings determine when and how files are fragmented. The use of fragments means that if a file is deleted, there may only be parts of it that are overwritten. Thus, the deleted file can be partially recovered.
The explanation I’ve given here is very simplified. Anyone in digital forensics is probably grinding their teeth at how much I have left out of this description. I wanted to keep this short and sweet for this venue.
Lesson: Before you discard any electronics that use any type of memory, make sure the memory has been wiped. There are memory cleaning tools that will do this for you. Most devices come with them pre-installed.
Tomorrow, in observance of Mother’s Day, we will look at a few of the mothers of cybersecurity.
Comments