2

If you cut and paste a file (in Windows specifically) within the same drive, are there effectively two versions of the file on the drive; one in the new location and the original file on the drive which is no longer 'visible'? I.e. does cut and paste really just copy and paste but delete the original file? Or does Windows just change the directory?

How can we securely move a file without leaving anything behind?

2
  • There are couple of useful resources and opinions (not windows official) on the internet which helps you about understanding "cut and paste" superuser.com issco.unige.ch quora.com sevenforums.com – 0_o Nov 6 '18 at 6:40
  • 1
    You should be clearer about what threats you are worried about. Are you trying to protect against attackers with low-level access to the disk? Attackers with must go through the Windows APIs and can read the old location but not the new one? Attackers using data recovery tools on the physical disk? – CBHacking Nov 6 '18 at 9:09
9

This depends on whether or not you are cutting and pasting into the same partition, not just the same drive. If you are pasting it into a different partition, then it will actually be copied, and the original subsequently unlinked. If, however, you are moving it within the same partition, only the metadata specifying where the file is located will change. This is the reason massive files can be moved (cut and pasted) within a given partition instantly, even if they are several gigabytes in size.

Note that this also applies to Mac OSX and most GNU/Linux distributions.

3

Cut-and-paste in Explorer (the Windows graphical shell) works exactly the same as calling some variant of the MoveFile API, probably specifically MoveFileExW with flags that copying the file is allowed (as this is necessary to "move" a file across network connections or physical disk partitions) and the write-through flag, instructing the function not to return until the disk has been updated with all changes including the deletion of the old file location (for "moves" that must be implemented as copy-then-delete operations). This is also generally the same behavior you'd get using the move or ren commands in cmd.exe (those commands do the same thing), dragging-and-dropping the file in Explorer, or so on. The system will perform a rename, rather than a physical move, if possible, as this is much faster.

Any successful move operation will mean the file is no longer reachable at its old path/name, effective instantly when the operation succeeds. However, the "deletion" done by a copy-and-delete "move" will leave the file's contents on the disk, and merely remove the file system entry and mark the space as free; any new data written to the disk may overwrite that space, but until it does, an attacker with low-level access to the disk could bypass the file system and access the file contents by reading the disk as a block device. "Moves" that take place within a single partition and are therefore simply implemented as a rename don't even change the physical location on the disk, only the logical path through the file system that points to the file's physical location. If you want to do a more thorough deletion - for example, by overwriting the file's old location - you should use an explicit Copy operation (CopyFileW, or copy-and-paste, or the copy command, etc.) and then perform your thorough delete operation on the old path.

0

There are 2 cases:

1. Across different partitions

Cut and Paste does a "copy to new destination" and "delete from old location" procedure.

If you stop it in the middle of the operation or if the copy halts due to various reasons some of your files will remain in the original location and some will be on the new location. Due to the strange sorting of files of this operation it will be very hard to figure out which ones are exactly if you have a very large amount of files.

Therefore, the better practice is just to copy the content to the new location and then delete from the old one. You practically have the same result, but it's a lot safer.

This is good for a move operation across different partitions.

2. On the same partition

If you do a move operation withing the same partition, the operating system will NOT make any copy and delete operation but will only alter the actual path of your data. So in the case you move within the same drive, use cut and paste, not copy-paste-delete.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.