What Actually Happens When You Delete a File

Deleting a file does not remove its contents. It removes the reference that lets the system find it and marks the space as available. The data sits there until something writes over it.

This has two practical consequences pointing in opposite directions: files are often recoverable when you want them, and often recoverable when you do not.

The stages of deletion

Moved to trash. Nothing has happened except a change of location. The file occupies the same space and is trivially restored.

Trash emptied. The reference is removed and the space is marked free. Contents remain until overwritten.

Overwritten. Something else was written to that space. Now it is gone, partially or entirely.

How long stage three takes depends on how much you use the drive. On a busy system, hours. On a drive you stopped using immediately, potentially months.

Recovering something deleted

Stop writing to the drive immediately. This is the whole game. Every additional file written risks overwriting what you want. Do not install recovery software onto the same drive.

Check the trash, including per-application trash — photo libraries, cloud storage and mail clients keep their own, frequently with a thirty-day window.

Check version history in cloud storage and in applications that keep it. This is the easiest recovery and the most overlooked.

Check backups. Faster and more reliable than any recovery tool.

Then try recovery software, installed to and writing to a different drive.

Success is not guaranteed and degrades with time. A file recovered may be complete, partial, or intact but without its name.

Why solid-state drives are different

On a mechanical drive, deleted data reliably persists until overwritten. On a solid-state drive it frequently does not.

TRIM tells the drive which blocks are free, and the drive erases them proactively as part of its own housekeeping. This is necessary for performance.

The practical effect is that deleted data on a solid-state drive may become genuinely unrecoverable within minutes, without anything being written by you.

This cuts both ways. Recovery from an SSD is far less likely. Secure erasure is correspondingly easier.

Erasing a drive you are giving away

The important case, and where the folklore is worst.

Deleting files and emptying the trash is not enough. Contents remain.

A quick format is not enough. It rewrites the index, not the data.

On an encrypted drive, destroying the key is sufficient and instant. Both platforms encrypt by default on modern hardware, so erasing the device through its own reset function discards the key and renders everything unreadable. This is the correct method and it takes minutes.

Check that encryption was actually on. FileVault on macOS, BitLocker or device encryption on Windows. If it was not, use the built-in secure erase for the drive.

Multiple overwrite passes are unnecessary on current hardware. The advice comes from research on drive technology from decades ago. One pass, or key destruction, is sufficient.

For a phone, the factory reset does this properly, because phone storage has been encrypted by default for years. Sign out of the account first, or the device may remain locked to you.

The parts people forget

External drives and memory cards. Handed on with the camera, still holding everything.

Old phones in a drawer. Not wiped, still signed in.

Printers, routers and other devices with storage and stored credentials.

Cloud accounts, which are not on the device at all. Signing out is not deleting.

Anything already backed up. Deleting a file locally does not remove it from backups, which is usually what you want and occasionally is not.

Deleting something on purpose

If you want a specific file genuinely gone:

On an encrypted drive, ordinary deletion plus emptying the trash is adequate for realistic threats, because the whole volume is unreadable without the key.

Remember every copy. Backups, sync services, email attachments, the version you sent to someone, the copy on the external drive.

Sync services keep versions. Deleting a file leaves it in version history for the retention period, and you may need to remove it there explicitly.

Physical destruction is the only certain method for a drive with genuinely sensitive contents that you cannot erase — a failed drive that will not respond, for example. Services exist for this.

The summary worth remembering

Deleted is not erased. Recovery is possible more often than people expect and less often on modern solid-state storage. Encryption turns the difficult problem of erasing a drive into the easy problem of discarding a key — which is why leaving encryption on is worth doing before you ever need it.