Your mistake is in assuming that the space is empty. When you delete a file in windows, it isn't actually gone - Windows essentially just removes the information from the file table, basically just making it so that there is no marker of where the file begins or ends. All the data will still be there until it is overwritten (and can even be recovered in that situation sometimes, although the quality will degrade with every rewrite).

To really get rid of something (without physically destroying the disk), you need to overwrite it several times with psuedorandom data (or a special pattern of data), which can be done using a program like Eraser.

I don't know of any freeware tools for recovery of deleted files, you'd probably have to pay for something if you were interested in that.

Hope that answers your question. [smile]

Quote:Original post by Mulligan
Thanks for the reply, but I was really asking how programs like Eraser work. They have an option to "Erase Unused Disk Space". How does THAT feature work?

They 'erase' the unused space (or space occupied by a file for that matter, it all works the same) by overwriting it with either pseudorandom data, or algorithmically generated data specially designed for the purpose. As a single pass doesn't completely remove the data (just as a new file being written over the top also wouldn't completely destroy underlying data), multiple passes are written in this fashion. Typically between 3 and 7 passes are used, but most programs will give the user the option to select the number of passes they wish to perform.

Because the empty space isn't in the file table, it will still show up as empty space afterwoulds, but will now contain pseudorandom data instead of the deleted data which previously exists. In the case of a file rather than empty space, a regular delete is performed before the overwrite - the effect is the same. Some programs of this type will also zero the unused space after the erasing passes, just for neatness, but this isn't required and has no real benefit.

Quote:Original post by Kazgoroth
As a single pass doesn't completely remove the data (just as a new file being written over the top also wouldn't completely destroy underlying data), multiple passes are written in this fashion.

I'm not quite sure what you mean.

Is it just that when writing a new file to the same spot, its unlikely to be the same size and take up exactly the same clusters, therefore some of the old file is still likely to be there?

Quote:Original post by Mulligan
How is it possible to tell the harddrive to overwrite an area where no files exist in the first place? Seems like the OS would prevent it.

Then, how would you go about creating a file, if you couldn't write to "empty space"? Just because you are restricted in what you can do in user mode doesn't mean the same restrictions apply to a program run in kernel mode.