What happens if you delete from Recycle Bin ?


👤 Diwas Poudel    🕒 02 Oct 2022    📁 TECH

Microsoft Windows is a user-friendly operating system. If you delete a file from wherever on your Windows computer, it will be sent to the Recycle Bin. However, if you delete the item from the Recycle Bin, you may think that the data has been removed permanently from your hard disk or SSD.

This is obvious because when they delete from the Recycle Bin, Windows File Manager shows an increase in file resource availability. But do you believe this is correct? The answer is a big NOOOOOO...

So let's deep dive into this.

What is Recycle Bin?

The Recycle Bin is a unique folder that can be found in the Windows operating system. It is used to temporarily store any files or folders that have been deleted from your local hard drive or solid-state drive (SSD).

🤖 Be aware that if you delete anything from an attached external hard disk, USB device, or flash drive, nothing will happen and the item will not be moved to the recycling bin.

When you delete a file or folder unintentionally and then realize that you need it back, the Recycle Bin appears to be very eager to help you retrieve it. To do this, navigate to the Recycle Bin, then right-click on the file or folder you wish to restore, and finally, select the Restore option.

Recycle Bin
fig. Recycle Bin

What happens if you delete it from Recycle Bin?

Each file on a hard disk may not be stored in fixed memory instead they are stored in contagious memory. Each file is divided into several parts, and each small part of the file may be located in a different sector of the hard disk. Those small part of the file contains two sections. One Section contains a pointer pointing to some remaining part of the file and another section contains actual data.  As a result, the pointer aids in the linking of all split parts of files. So when someone opens a file the pointer helps to get all the file content at a time.

Following that, When you delete a folder or file from the Recycle Bin, or when you hard delete (by pressing Ctrl+Shift+delete), only the pointer part of the field is changed, and the data content of the file remains untouched until other new contents overwrite it. So, We can conclude that data still exists in a sector of your hard drive unless it has been overwritten. As a result, various forensic recovery tools can recover deleted files from the recycle bin.

Small part of file with Data and Pointer
fig. Files Pointer and Data Part

In other words, when you delete something from the disk, the data that was erased is simply deallocated. This is what occurs when you delete something.

In other words, When you delete files and folders from the Recycle bin, the pointer in Windows that was previously pointing to the file location is removed. Instead, it will point to another free place that is now accessible. From the perspective of the operating system, the sector containing the content file (that is, the deleted file) is regarded to be free. In addition, this space can be utilized at a later time to store additional data.

Note: They cannot recover if that content is completely overwritten by some other content.

For laymen,

Consider it similar to renting a hotel room. When you rent a room, the owner gives you a key so you can lock the door and no one else can enter.

When you leave the hotel, you return the key to the hotel's owner or manager.The room is now empty, and the owner can give the key to anyone else.

As you can see, the primary role is Key. So, when you leave the room, you give the key to the owner and the owner can give a key to someone else ie. from an OS perspective, if the pointer is removed then other data can be inserted in the same location.And if pointer is bind to certain data then OS will not overwrites those data.

SSD mechanism for handling Deleted Files?

Everything we've discussed so far applies to HDDs, but when it comes to SSDs, the mechanism for dealing with deleted files is different. Let us talk about it.

TRIM Command is used by currently available SSDs if they are enabled. Using this command will immediately remove any data blocks associated with a deleted file, making it possible for another file to occupy that space. When the operating system has to write data onto the disk in the future, the writing process will be improved significantly. TRIM can be implemented on solid-state drives (SSDs) in a variety of different ways, depending on the operating system that is being used. While TRIM is being executed by some operating systems immediately following the deletion of each file, other operating systems will execute TRIM at predetermined time intervals.

Check TRIM is enabled in your SSD 

To check TRIM command enabled or not here are the steps.

1 Open Cmd with admin previlege.

2 Then paste the below code and press Enter.

fsutil behavior query DisableDeleteNotify

3 If the result is 1 then it is enabled else we have to enable it.

Trim Command

How to enable TRIM command ?

You can run the following command in command prompt.

fsutil behavior set DisableDeleteNotify 0

How to disable TRIM command ?

You can run the following command in command prompt.

fsutil behavior set DisableDeleteNotify 1

Conclusion:

As a result, even if you delete from the Recycle Bin and the deleted location is not overwritten by other data, Data Recovery tools can recover the deleted data.