Are deleted files more or less likely to be overwritten than blank space?

Question

Let's say that I have some files on a hard drive (the data for each file is represented by a different letter):

xxxoooozzzz--------------------

 

Now let's say that I delete file Z without securely wiping it. The file will still be on the hard drive until something overwrites it:

xxxoooozzzz--------------------

 

Now let's say that I decide to create a new file (b). This will take up some of the remaining space on the hard drive. My question is, does the hard drive or operating system take the deleted files into account when deciding where to put the data for the new files?

 

From a convenience perspective, it seems like it would be best for the hard drive/OS to intentionally avoid overwriting deleted files, like this:

xxxoooozzzz---------------bbbbb

By doing that, I would have a higher chance of recovering File Z if I later realized that I wanted it back.

 

From a security perspective, it seems like it would be best to do the opposite and instead prioritize overwriting old files, to help prevent deleted data from being recovered by a malicious third party. For example, like this:

xxxoooobbbbb-------------------

 

My question is, are either of these things actually taken into account when writing new data? Or is the new write location essentially just random?

Answer 1

Yes, I take them into account.

On HDDs it's more like o be overwritten compared to being stored into free space, because the tendency is to put the data into the faster portion of the drive which is at the beginning of it.

For SSDs, in theory, the data should be allocated to the less used sectors, which means there's a higher chance data will land into the free space compared to reusable one.

Answer 2

A lot will depend on the storage medium.

For SSD's, the wear-levelling algorithm will try to use different blocks each time, so data remains for much longer than HDD's, which may be random or tend to start from the earliest "free" space.

Filesystems designed with security in mind don't tend to use deliberate overwriting using the next file to be written as their security mechanism. They typically use deliberate overwrites on release, or encrypted storage.