# Computer Experts Can You Answer This?



## GB (May 22, 2009)

This is something I have been wondering for a while. We have all heard that when you put something on your hard drive it is almost always there forever. Even if you erase it the information can almost always still be recovered. There are ways to completely erase the information, but it takes a little knowledge and effort. It is not just as quick and simple as dragging a file to your recycle bin.

So my question is this...If the information is not really erased when we just the basic drag and drop into the recycle bin, why do we need larger hard drives? Why do we run our of hard drive space?


----------



## Andy M. (May 22, 2009)

Every file saved on the hard drive has a numeric tag on it.  When you save a later version of that file, the extra bit is saved in a separate location because the original file is boxed in whith other stuff thath happened in between.  When you re-open a file, the computer collects all the bits with te same file number and puts them together.

When you delete a file, all you are doing is erasing the file number.  The rest stays on the drive until something else overwrites it.

At least, that's how it was explained to me...


----------



## GB (May 22, 2009)

My understanding Andy is that the data needs to be overwritten a number of times to really remove it. There are programs that claim to completely remove the data from your hard drive. They do this by overwriting the data many times. If overwriting it once or twice or even 10 times does not really remove it (it can be recovered by someone who knows what they are doing) then why do we need such large hard drives? If the data is still really there why can't we get away with having a 1 gig drive since the information is still there even if we think we are erasing it?


----------



## Andy M. (May 22, 2009)

The other component to this is the size of the files we store.  Photos, movies, etc., and the software we load.


----------



## GB (May 22, 2009)

But that is just my point Andy. Lets say, for the sake of simplicity, that we have a 1 gig drive. We then load a picture that is 1 gig. We have taken up all the space on the drive. We then erase the picture file and add another different picture that is 1 gig. Well even though we erased the first file it is still recoverable by someone who knows what they are doing, thus there is really 2 gigs of information somewhere on that 1 gig drive.

1 gig file, erased, but recoverable
+
1 gig new file currently on the drive
=
2 gigs on a 1 gig drive


----------



## Andy M. (May 22, 2009)

I am happy to keep you occupied until and actual computer expert comes along to answer your question but we have now exceeded the scope of my knowledge.  

How about those Red Sox!


----------



## GB (May 22, 2009)




----------



## Alix (May 22, 2009)

Every GB has a secret shadow GB lurking beneath to store the recoverable data. Either that or what we are told requires 1GB actually only requires 1/2 GB and the other half is in reserve for erasure and recovery. 

I have no idea. I'm just making this crap up. But it sounds good doesn't it?


----------



## GB (May 22, 2009)

LOL when i first read your post Alix I thought you were talking about me (GB), not gigabites (GB)  I am not too swift sometimes!


----------



## Alix (May 22, 2009)

OMG!!! I am only now able to type again. WHOO! Tears running down my face. So...are you the REAL GB or the shadow GB today???


----------



## GrillingFool (May 22, 2009)

Once the item is deleted, the computer marks its spot on the drive as available, and begins to overwrite it with new data. What can still be recovered are just pieces of the old item. 
In your example, both files filled the available space on the drive, so there probably wouldn't be much to recover from the old file. A 1 gig drive with a 1 gig photo uses up the entire drive. Deleting it and saving a NEW 1 gig file would use up all the space, effectively (I think) overwriting the deleted file.

Think of it this way....
Say that the file on your drive is a 400 page book. When you delete it, the computer starts to overwrite the book. So when you go to recover the deleted file,
you might only get page 32, pages 100-111, page 45, half of page 333, and pages 298-322, plus the third line from page 2 and 12 words from pages 334 and 4 words from page 400.
Once a bit of info has been overwritten, it is gone, but the parts not yet overwritten are still recoverable.

As I understand it, anyway.


----------



## GB (May 22, 2009)

I understand it completely differently GF. The erasing programs that effectively erase your hard drive completely do so by over writing the data with other data many many many times. If what you were saying were true then you would only need to over write the data one time completely and then the original data would be gone forever. This is not true though. Even after the entire drive has be over written, even 3 or 4 times lets say, someone who knows how can still recover some if not all of the original data.


----------



## GB (May 22, 2009)

Alix said:


> So...are you the REAL GB or the shadow GB today???


Only the shadow knows.


----------



## GrillingFool (May 22, 2009)

Is overwritten data really unrecoverable? - Computerworld Blogs


----------



## GB (May 22, 2009)

Interesting article. Thanks GF.


----------



## msmofet (May 22, 2009)

when you erase or delete something you just make it invisable (unavailable for you to see). and info is writen over the top. like repainting a wall - the old paint is still under there. you would need to strip the old paint to completely remove the old paint. there are back ups of your data to be used for a system restore (when you can go back in time and restore info you lost by deleting it). you can do a government shred which chops and scatters the data but it is still there in peices.

to totally erase the drive and make nothing recoverable you need to write the drive to zeros which is like degaussing a video tape. thats how it has been explained to me.


----------



## GB (May 22, 2009)

That is how I always understood it too msmofet, but if that is true then why do we need large drives. As you described, drives essentially have unlimited space since info is just piled on top of info. If that were really the case and information was not lost, but just invisible then theoretically we would be able to have a very small drive, but have much more info on it than you would think you could. That is not true though.


----------



## Andy M. (May 22, 2009)

GB said:


> That is how I always understood it too msmofet, but if that is true then why do we need large drives. As you described, drives essentially have unlimited space since info is just piled on top of info. If that were really the case and information was not lost, but just invisible then theoretically we would be able to have a very small drive, but have much more info on it than you would think you could. That is not true though.




GB, that would be true if you always deleted stuff and never used your hard drive to store files.  No one does that.  Our hard drives are loaded with stuff we keep, not discard.


----------



## GB (May 22, 2009)

We delete stuff because we run out of space though Andy, so if it were true that data is never really removed from the hard drive then all we would have to do is put something on the drive then delete it. It would still be on the drive, but invisible. You could then put your next item on and delete it and on and on. Then you would only need to retrieve the file you need when you need it and then delete it again freeing up that space when you are done. 

If the article that GF posted is correct then that explains that what we have always been told is not really true, which would make the most sense to me.


----------



## blissful (May 22, 2009)

I would have the opinion that once a drive is over written, very little if any of the original file is recoverable.
We format our drives when we dispose of them by slamming them against a concrete floor, so no data is recoverable. I'm not so sure that's the best way.
When we recycle, we have the company sign an agreement to erase the data and make it unrecoverable, it's corporate data.
We had 'very important person's hard drive' and it was not working. We ended up sending it out to recover files to the tune of $3500 with no guarantees. The disk was not revolving in it's case. The only way they could recover the data was to rebuild the case around the disk-I think that's what they did. They didn't try to recover data under written data and I could imagine that being incredibly expensive if the top copy was $3500.
If I wrote something I wanted to erase, I'd delete it and write over it. (the space)
I would defragment the disk, erase the thing I wanted erased, then over write the area and defragment it again. That's what I would do for my files.


----------



## GB (May 22, 2009)

blissful said:


> I would have the opinion that once a drive is over written, very little if any of the original file is recoverable.


then why do you always hear about the police getting hold of hard drives and recovering information that was supposedly erased? Maybe that really does not happen as much as I think it does. Perhaps I am confusing TV with real life.


blissful said:


> We format our drives when we dispose of them by slamming them against a concrete floor, so no data is recoverable. I'm not so sure that's the best way.


I do the same thing. I then take a hammer to it and go to town. It might not be the best way, but I am confident that it is enough so that someone would need to have a real reason to try to get any info and since my most sensitive data is my baning info and I am far from rich I doubt anyone would go through any real effort to try to get my data after I smash the drive to bits.


----------



## blissful (May 22, 2009)

GB said:


> then why do you always hear about the police getting hold of hard drives and recovering information that was supposedly erased? Maybe that really does not happen as much as I think it does. Perhaps I am confusing TV with real life.


I think the police and detectives WANT you to believe they CAN recover whatever, about whatever. If a person deletes something, it's recoverable if it isn't overwritten. Which is why I think a person needs to make sure it's over written if they want it erased. There's a BUNCH of bravado with authoritarian type police and detectives, that they have SO much power or knowledge--oh yeah. And there is so much they don't know, like in my state their driving, criminal, divorce etc records are on an online database, so you can look it up, as an average citizen. It makes them crazy, they think you know because you are stalking them...lol. They like to 'talk' a lot, it makes them crazy. Crazy people with guns, how cool is that? Versus average people w/ or w/o out. Don't ask me how I know.I'd be a good asset to a detective force needing IT help.


----------



## bullseye (May 22, 2009)

GB--

A hard drives files if simply erased and removed from the trash bin can still be easily recovered if _all_ the sectors occupied have not been overwritten.  This is done using a compression algorithm known as lossy compression--the parts of the file not available are predictable to a high degree by the pattern that is left.  The scenario you describe is somewhat different, i.e. the writing of a file of exactly the same size in the same space.  It is a lot trickier, but files pieces do not use every bit in every cluster.  Even if eash and every bit, however, is overwritten, there is a residual magnetic charge left from the old image.  It is sometimes called a palimpsest, which derives from the time when writing material was very expensive.  When the usefulness of the document was over, it would be scraped clean and reused, but it was still possible to rescrape it and recover what had been underneath.  Similarly, data written on magnetic media over other data can be "scraped" off to allow access to what underlies it.  This can be done because the magnetic particles that are used to store binary data have a memory once written to.  It is possible, though expensive and tedious, to go back two or three iterations of data written and overwritten.  The only--so far--reliable method of completely erasing data from magnetic media such as hard drives is to write a bit-wise pattern of zeroes many times, effectively reducing the magnetic residual memory to an unusable state.  The hammer method would not deter a determined tech with enough funding and at least most of the pieces.  Hope that helps!  (BTW, just what are you trying to erase? )


----------



## msmofet (May 22, 2009)

like i said you need to write the drive to zeros to completely erase the drive. without the 1's there is no info.


----------



## bullseye (May 22, 2009)

msmofet said:


> like i said you need to write the drive to zeros to completely erase the drive. without the 1's there is no info.



Yes, but you need to do it several times, at least.


----------



## jet (May 22, 2009)

You need larger hard drives for a number of reasons:


Microsoft Windows is sloppy, and accumulates junk which slowly takes up additional disk space.
As hard drives have gotten bigger, applications and data have also gotten bigger.
Users accumulate more "stuff" on their hard drives (e.g. pictures, video clips).
As previously stated, when you delete a file, it's not immediately gone.  It is simply removed from the file allocation table.  That means if you hit delete the second before the cops kick in the door, you're sunk.  If you deleted it months ago, the chances are much lower that the data can be recovered.


----------



## jet (May 22, 2009)

bullseye said:


> Yes, but you need to do it several times, at least.


I you write zeros over every bit on the hard drive (just one time), what could possibly be left to recover?


----------



## msmofet (May 22, 2009)

jet said:


> I you write zeros over every bit on the hard drive (just one time), what could possibly be left to recover?


there isn't anything to recover. zeros are zeros. the drive can't read just zeros it needs the ones also, thats what makes it readable.


----------



## bullseye (May 22, 2009)

jet said:


> I you write zeros over every bit on the hard drive (just one time), what could possibly be left to recover?



To even the casual geek, nothing.  I have, however, recovered data from hard drives that have been low level formatted (theoretically returned to the factory state), partitioned in a different way, and populated with new data.  It's all a matter of how much time you can spend.  For the why, see my first post in this thread.


----------



## GB (May 22, 2009)

bullseye said:


> GB--
> 
> A hard drives files if simply erased and removed from the trash bin can still be easily recovered if _all_ the sectors occupied have not been overwritten.  This is done using a compression algorithm known as lossy compression--the parts of the file not available are predictable to a high degree by the pattern that is left.  The scenario you describe is somewhat different, i.e. the writing of a file of exactly the same size in the same space.  It is a lot trickier, but files pieces do not use every bit in every cluster.  Even if eash and every bit, however, is overwritten, there is a residual magnetic charge left from the old image.  It is sometimes called a palimpsest, which derives from the time when writing material was very expensive.  When the usefulness of the document was over, it would be scraped clean and reused, but it was still possible to rescrape it and recover what had been underneath.  Similarly, data written on magnetic media over other data can be "scraped" off to allow access to what underlies it.  This can be done because the magnetic particles that are used to store binary data have a memory once written to.  It is possible, though expensive and tedious, to go back two or three iterations of data written and overwritten.  The only--so far--reliable method of completely erasing data from magnetic media such as hard drives is to write a bit-wise pattern of zeroes many times, effectively reducing the magnetic residual memory to an unusable state.  The hammer method would not deter a determined tech with enough funding and at least most of the pieces.  Hope that helps!  (BTW, just what are you trying to erase? )


Thanks bullseye. This actually helps a lot. So basically, often times the data is still really able to be recovered, but it is cost prohibitive.


----------



## msmofet (May 22, 2009)

bullseye said:


> To even the casual geek, nothing. I have, however, recovered data from hard drives that have been low level formatted (theoretically returned to the factory state), partitioned in a different way, and populated with new data. It's all a matter of how much time you can spend. For the why, see my first post in this thread.


 is there a free app that can write zeros to a laptop with vista, out there?


----------



## bullseye (May 22, 2009)

GB said:


> Thanks bullseye. This actually helps a lot. So basically, often times the data is still really able to be recovered, but it is cost prohibitive.



That is absolutely correct, GB.  The cost can easily run into the thousands; the really advanced stuff can be well into the tens of thousands.  The state of the art stuff, I have no idea.  It needs to be really worthwhile.


----------



## msmofet (May 22, 2009)

also bullseye how do i reset my IP? i can no longer get onto a favorite board and i have lost my JAVA options in the advanced tab of internet options.


----------



## bullseye (May 22, 2009)

msmofet said:


> is there a free app that can write zeros to a laptop with vista, out there?



Yes, but not, as far as I know, selectively and effectively.  You need to erase all and start from scratch.


----------



## bullseye (May 22, 2009)

msmofet said:


> also bullseye how do i reset my IP? i can no longer get onto a favorite board and i have lost my JAVA options in the advanced tab of internet options.



For the IP reset, open a command prompt, type "ipconfig /renew" and hit enter.  I'm not sure what your JAVA issues are; can you expand?


----------



## msmofet (May 22, 2009)

bullseye said:


> Yes, but not, as far as I know, selectively and effectively. You need to erase all and start from scratch.


 well i had something go whacky and i now can't get onto a board that i know is fine. i spoke to the owners and they say it is not on their side. and said maybe i need to reset my ip.  i can't get onto that board using any stand alone browser like chrome, firefox, netscape or avant even AOL explorer doesn't work. i CAN get onto the board through the AOL platform which i hate using except to get my email. i have lost jave options and no java appears in my add/remove but i know it is there. i think there are some components of java missing. i have done a complete reinstall of my OS but it did not cure the problem with java or the website. when vista does a reinstall it places a copy of the old files in my c drive. not a partion. when i open computer in the laft pane it has local disk c and in the list there is listed:
windows 
windows.old

i had a program to write my XP to zeros but i don't think it will work for this puter.

any help would be useful.


----------



## jet (May 22, 2009)

bullseye said:


> To even the casual geek, nothing.  I have, however, recovered data from hard drives that have been low level formatted (theoretically returned to the factory state), partitioned in a different way, and populated with new data.  It's all a matter of how much time you can spend.  For the why, see my first post in this thread.



Formatting a hard disk drive (HDD) does not erase it.  I was simply pointing out that if you write zeros over every bit on a HDD, there is absolutely nothing left to recover.  Some utilities will write random ones and zeros over every bit and make multiple passes.  That's not to be thorough, but to attempt to conceal the fact the wipe every took place.

There are a couple of points on the data recovery issue that I failed to mention.  Things like System Restores, temporary files and meta data are often overlooked.  The enormous size of HDD's themselves can be a problem.   Let's say you have a 250GB HDD that has 199GB of free space and today you delete a 1GB file.  Tomorrow you have 200GB free and you add a new 1GB file.  What are the chances that the new file will overwrite the old file (which still physical resides on disk)?  That file, or significant portions of it, might easily still exist in six months.


----------



## bullseye (May 22, 2009)

msmofet said:


> well i had something go whacky and i now can't get onto a board that i know is fine. i spoke to the owners and they say it is not on their side. and said maybe i need to reset my ip.  i can't get onto that board using any stand alone browser like chrome, firefox, netscape or avant even AOL explorer doesn't work. i CAN get onto the board through the AOL platform which i hate using except to get my email. i have lost jave options and no java appears in my add/remove but i know it is there. i think there are some components of java missing. i have done a complete reinstall of my OS but it did not cure the problem with java or the website. when vista does a reinstall it places a copy of the old files in my c drive. not a partion. when i open computer in the laft pane it has local disk c and in the list there is listed:
> windows
> windows.old
> 
> ...



OK, I don't want to derail this thread about GBs question and turn it into tech support.  I don't mind helping out, though, so why not PM me and I'll see what I can do.

BTW, your zeros program for XP probably didn't do what you thought it did; if the boot sector and whatever is used for file allocation control are not also overwritten, you're in the minor leagues.


----------



## bullseye (May 22, 2009)

jet said:


> Formatting a hard disk drive (HDD) does not erase it.  I was simply pointing out that if you write zeros over every bit on a HDD, there is absolutely nothing left to recover.  Some utilities will write random ones and zeros over every bit and make multiple passes.  That's not to be thorough, but to attempt to conceal the fact the wipe every took place.
> 
> There are a couple of points on the data recovery issue that I failed to mention.  Things like System Restores, temporary files and meta data are often overlooked.  The enormous size of HDD's themselves can be a problem.   Let's say you have a 250GB HDD that has 199GB of free space and today you delete a 1GB file.  Tomorrow you have 200GB free and you add a new 1GB file.  What are the chances that the new file will overwrite the old file (which still physical resides on disk)?  That file, or significant portions of it, might easily still exist in six months.



I didn't say "format," I said "low level format."  Different thing, entirely.  A single pass of zeros does not remove the underlying data.  

At this point in the thread I want to say that I only jumped in to answer a valid and interesting question from GB.  I do this kind of thing for $$$ and DC for my love of cooking.  I'm not on the clock, so I'm going to head off to find something interesting to do with the lamb chops on the  counter.  No offence intended, and if you want some links and/or white papers, let me know.


----------



## jet (May 22, 2009)

bullseye said:


> I didn't say "format," I said "low level format."  Different thing, entirely.  A single pass of zeros does not remove the underlying data.
> 
> At this point in the thread I want to say that I only jumped in to answer a valid and interesting question from GB.  I do this kind of thing for $$$ and DC for my love of cooking.  I'm not on the clock, so I'm going to head off to find something interesting to do with the lamb chops on the  counter.  No offence intended, and if you want some links and/or white papers, let me know.



If you write zeros over every bit on a HDD, there is *absolutely* never left to recover.

As for your second point, I couldn't agree more.  This is supposed to be a holiday weekend.  Let's go cook something.


----------



## bullseye (May 22, 2009)

jet said:


> If you write zeros over every bit on a HDD, there is *absolutely* never left to recover.
> 
> As for your second point, I couldn't agree more.  This is supposed to be a holiday weekend.  Let's go cook something.



First point, I reiterate, do it several times on the whole drive, at least if you don't want the forensics guys to get it.

Second point, thanks, I did.  Herbed lamb chops, compound butter, LO roasted potatoes and corn.  Quick and delicious!  Enjoy the weekend, jet!


----------



## Foodfiend (May 26, 2009)

Well, here's another question for you computer experts out there.  I just recently had my computer repaired (had a nasty virus taken out) and now my mouse icon is working in slow mo.  When I move my mouse, the mouse icon takes 2 or 3 seconds to respond whereas it was instantaneous before.  It only happens when I'm on the net or going through my e-mails (which is probably part of the net also).  Is there anything I can do to fix this myself, or do I take it back in to where I had it fixed earlier?  It seems as if I've had this problem before but can't remember how it's done, so any help would be much appreciated.

Thanks.


----------



## bigdaddy3k (May 26, 2009)

Foodfiend said:


> Well, here's another question for you computer experts out there. I just recently had my computer repaired (had a nasty virus taken out) and now my mouse icon is working in slow mo. When I move my mouse, the mouse icon takes 2 or 3 seconds to respond whereas it was instantaneous before. It only happens when I'm on the net or going through my e-mails (which is probably part of the net also). Is there anything I can do to fix this myself, or do I take it back in to where I had it fixed earlier? It seems as if I've had this problem before but can't remember how it's done, so any help would be much appreciated.
> 
> Thanks.


 
Go to control panel (start, control panel) and click on the mouse icon. In there you can find settings to change your mouse's response time.
Shadow BD.


----------



## Elo (May 26, 2009)

You could also be CPU bound.  If you bring up task manager with CTRL-ALT-DEL and order by CPU usage then replicate the process, see if one of the spikes to 90-100% usage.  If it does, that could be the problem.


----------



## Foodfiend (May 27, 2009)

Thanks for the tips.  My mouse feels as if it's running better with a few minor hiccups now.  If it doesn't completely solve this and clear up I might try the other one.

Thanks


----------

