Lets say we delete various files , from hard disk A, with shift - delete , windows 8 . Then we copy new files to the same hard disk A. Then those new files we just copied there to hard disk A, we copy to a USB stick , or to a DVD. Those new copied files are now laying to a total different hard disk drive B . Is there anyway , those new copied files that came from the hard disk A , but now laying in the different hard disk B , to include any traces of the previous deleted files from hard disk A , so that recovery software be able to recover , if we run the recovery software from the hard disk B ? I only used normal windows explorer copy and paste, for copying the files.
2 Answers
It depends on how you copy them.
If you do a bitwise copy, aka exactly replicating every single bit from one disk to the other, you are copying over "slack space" which is where the recovery tool will work.
If you do a file copy, then the empty space of the disk is ignored, and only the segments of data attached to a file header will copy over. The recovery tool cannot see the slack space attached to the other disk.
-
Thank you Ohnana for your detailed reply. I used the normal windows explorer copy paste method. So I assume it's the 2nd option of your reply , right ? That the recovery tool cannot see the slack space attached to the other disk , so no traces of the previous deleted files are copied ?– VonzarJan 15, 2016 at 23:48
-
-
Thank you again!I was skeptical about it for the reason that file shredding need to use methods like guttman x35,or x7 overwritten methods of empty space to secure safe deletion of data.So I assumed that when I write new files on the hard disk drive after I deleted previous files,there is probably a chance for the new files that are being copied to overwrite the empty space just once(x1).So maybe some traces of the previous deleted files are left on that new over written files,since it's only x1 times overwrite method with a simple copy paste of windows explorer.That's probably wrong?– VonzarJan 16, 2016 at 0:14
-
Ohnana Is it possible to share your knowledge with the question above this comment ? Thank you in advance.– VonzarJan 17, 2016 at 8:33
-
I don't quite understand what you're saying. If you copy files with explorer, you do not write any trace of deleted files. Writing over slack space once is enough to deter most commercially available recovery tools. To deter professional tools and high-resource ways of recovering files, overwriting 7-35 times is needed.– OhnanaJan 17, 2016 at 14:40
TL;DR; It depends how you moved it.
If you have never moved the files to Hard Drive B, it won't carry over the traces.
The way the files are stored on a hard drive would leave traces of the file on Hard Drive A (gets overwritten over a period of time). The difference is that when you copy files from one hard drive to another, it only copies the files you selected and skips the rest of the platter (skips the traces of deleted files).
Now, there's an exception to this. If you Clone the hard drive (I.E. Sector-to-Sector copy), that can carry over those traces because cloning the drive itself brings over all data on the platters (deleted or not).
Hardware cloning is usually a sector-to-sector copy, moving over everything to be the exact same (including partition sizes).
Software cloning is more flexible, because it can do both an exact copy of the platter (bringing over traces of the deleted file) or copy only the existing files (skips deleted files). Don't misunderstand when I say deleted files, I do not mean files left in the Recycle Bin.
I could be missing some information here, but I hope this answers your question.
-
Thank you dakre18 for your kind reply. I only used normal windows explorer copy and paste. So I assume everything is safe and no traces of the previous deleted files are carried over , right ?– VonzarJan 15, 2016 at 23:51
-
That's correct. Windows will not move permanently deleted data, but if it is sitting in your recycle bin, it still can. Once it's been deleted from there, think of it like a fingerprint on some glass, because once you remove your finger from the glass the fingerprint is still there (traces of files on the HDD platter). Once another fingerprint (I.E. files or data) overlaps it, then it becomes harder to see the first fingerprint. At some point it gets wiped clean or overlapped until it's completely gone. Analogies can sometimes make it easier to understand, even if it isn't the best.– dakre18Jan 16, 2016 at 7:11