How does recycle bin work (hardware layer)?

Question

I'm interested what would happen with the hardware (hard disk) when deletes a file.

I mean, I'm looking for some information about the process in hardware when the user decides to erase all the files from recycle bin.

I'm interested in Windows OS. I just found technical information like this: Data erasure http://en.wikipedia.org/wiki/Data_erasure

Any doubt or question, please let me know.

Answer 1

Each file system has a way of removing or releasing a file. the sectors on disk do not get wiped, eventually they may get reused for some other file and over time the old, deleted, file is not there.

If you read even the first sentence of the page you linked you see "a software-based method", the hardware knows nothing of files or file systems definitely not files with an abstraction of recycle bin (directory entry simply moved to some other directory, file not moved nor deleted when it goes in the recycle bin). The hardware deals with spinning motors, moving heads, finding/reading/writing sectors. The concept of partitions, files, deleted or not are all in the software realm, hardware does not know or care.

The article you referenced has to do with the media. Think about writing something with pencil on paper, then erase it and write something else. The paper has been compressed by the pencil both times, with the right tools you can probably figure out some or all of the original text from the indentations in the paper. You want to sell or donate or throw out a computer how do you insure that someone doesnt extract your bank account or other sensitive information? On that piece of paper, well you could burn it and grind up the chunks of ashes (cant sell that paper for money at that point). Or you could in a very chaotic and random way scribble over the parts where you have written, such that the indention in the paper from your original and second writing are buried in the noise. In addition to random scribbles you also write words, real words or letters but nothing sensitive, just to throw off any attempt to distinguish scribbles from real letters. The hard disk hardware is doing nothing special here it is spinning motors, moving heads, seeking to sectors and reading and writing them, nothing special. What the software is doing is trying to make those random scribbles that look just enough like real information to not have the real information stand out in the noise. You have to understand a bit about the encoding of the data, a 0x12345678 value does not use those bits when stored on the hard disk, to make the read-back more reliable the real bits are translated to different bits, and the reverse translation on the way back. So you want to know to choose chaotic patterns that when laid down on the disk actually exercise all the points on the disk not some and skip otherse. Ideally causing each location on the disk (for lack of a better term) get written with both ones and zeros many times.

Interesting related history lesson if you bear with me. there were these things called floppy disks. http://en.wikipedia.org/wiki/Floppy_disk there was a long history but in particular in the same size of disk the density changed (again this happened more than once). The older technology did what it could it laid down sectors using "bits" for lack of a better term as small is it could. Later, technology got better, and could lay down bits or less than half the size. You could take a disk written in the old days, and read it on the new drive. You could overwrite files on that disk with the new drive and reuse the disk (with the new drive). You could take a new disk and write files on the new drive and read on the old drive, but if you took an old disk with files written by the old drive, deleted and overwrote new files on the new drive, you couldnt necessarily read those files on the old drive, the old drive might actually see the old files or new files or just fail to read anything. To reuse that disk from the new drive to the old drive you had to format the disk on the old drive, then write files on the new drive, then read on the old drive...why...On a whiteboard write some words in block letters, big letters one foot tall. Take the eraser and erase only a two inch path through the middle then write some words two inches tall. Can you read both? Depends on what you wrote but often, yes you can. On a clean white board, write two inch letters, can you read the words you wrote, yep. The newer drives always had a smaller focus, they didnt write big fat bits when the disk was formatted using the older, smaller size, and small bits when writing on a disk formatted at the higher density, they always wrote the small sized bits. When reading the old disks they read the bits okay despite the huge size, when erasing and re-writing was like the big letters on the white board, they only erased a path through the middle, and wrote in that small path. The new drives could only read along the narrow path, they could only read the two inch letters and didnt see the big 1 foot letters at all. the old disk saw both the old one foot letters and the two inch and depending on which one had the dominant bits it would read that or often just fail to read either.

These disk erasures want to do the same kind of thing, every time you spin the media and move the heads its not exactly perfect, there is some error, you are not changing the charge on the exact same set of molecules on the media every time there is a bit of a wiggle as you drive down that road. Take a road for example. The lanes on a road are wider than the car, if you were to have a paint brush the width of the car, and painted a line the first time you drove down the road, and now you want to paint over that line so that nobody can determine what your original secret color was. You need to drive that road many many times (no cheating you cant hug one side of the road one time and the other side of the road the other time, every time you need to pretend to be hardware and do your best job to always be as close to the middle as you can, as hardware you dont know what the goal of the software is) to allow the error in position on the first pass to be covered by the error in the latter passes. You want to use a different color paint on each pass so that eventually the edges of the painted stripe is a rainbow of colors, making it impossible to tell which one was the original color. Same here beat up the hard drive with many many passes of writes, use ever changing and different data each pass, until the point that the original charge from the original write cannot be isolated and interpreted even on the edges.

Note that a solid state flash based drive works differently, there is likely a write leveling scheme to prevent some portions of flash to wear out before others. And you might get away with the same software level solution (the software doesnt necessarily know it is an ssd vs mechanical drive) or it may not work and a new solution is needed. The problem with ssd it is flash based so there is a limited number of write cycles before you wear it out, pounding on it with lots of chaotic writes, just wears it out.

What does any of this have to do with windows and the recycle bin, absolutely nothing, you send something to the recycle bin it is not much different than copying it to another directory, nothing is destroyed. When you delete the file most of the file is still there, intact, on the directory entry and perhaps some sort of file allocation table, something that lists free sectors from used, is changed, the sectors themselves do not necessarily change, your data is there, and really easy for someone with the right tools to read all of your "deleted" files (shortly after deleting them).

If you dont want people to see your old data, remove the drive, open and remove the platters and grind them into dust. That is the only guaranteed method of destroying your sensitive information.

Answer 2

Recycle bin is not related to hardware. It is just a special folder. When you move a file/folder into recycle bin. Windows just calls ZwSetInformationFile to 'rename' it. As you know, when a file is opened. You can't delete/remove it directly but you can rename it. Recycle bin is working like this. Then, when you try to empty the recycle bin, it just remove files/folders from file system. (Actually, it just set a flag of file in file system. The data did not be erased directly).

That's all.

Thanks.

Answer 3

There is no "process in hardware". Emptying the recycle bin just performs a bunch of file delete operations, which means marking some blocks as no longer allocated, and removing directory entries from directories. At the hardware level, these are just ordinary disk writes. The data isn't destroyed in any way. For more details, look up a reference to the filesystem you're using (i.e. NTFS).