Abstract
When you delete a file, by accident or on purpose, is the information really gone? Can you get it back? If you accidentally deleted your five-page report for school, you are hoping it is not gone. On the other hand, if you do not want someone to get their hands on the goofy and unflattering pictures you and your best friend took while staying up late the other night, you probably hope it is gone for good! It might be nice to know for sure either way. Try this project to find out.Summary
Objective
Experiment to see what it takes to completely delete a computer file.
Introduction
You deleted the file—it is gone. Or is it? This is a question computer experts get asked often. Sometimes the question comes from frantic students who accidentally deleted a long, hard-to-write paper. Sometimes the question comes from police officers or lawyers working on a criminal case. Either way, the person asking is desperate to know the answer.
In a criminal case, it is the job of a forensic computer analyst to find out the answer. The analyst uses sophisticated tools to carefully and painstakingly look through a suspect's computer to recover evidence from saved files—and even files the suspect thought they deleted. In this project, you will do a similar task. You will search for computer files that may or may not have been deleted using several possible deletion techniques. Before you get started, you need to know a bit about how computers store information and what it means to delete something. We will give you a basic explanation here, but you should check out the resources in the Bibliography section for a more complete understanding.
When a file is saved to a computer's hard-disk drive, the file is stored in multiple sections, called clusters, on the hard drive. The number of clusters that the file takes up depends on how much information is in the file. The more information, the larger the file, and the more space it takes on the hard drive. The computer only saves a file to clusters of the hard drive that it thinks of as "empty." It also creates a record of where it stored the file in a large table. The table tells the computer what files are stored where. In Figure 1 you can see an illustration of a book report stored across several clusters of a hard drive with empty hard drive space on either side.
Image Credit: Sandra Slutz, Science Buddies / Science BuddiesData that is stored on a hard drive is spread across small groups called clusters. Twelve squares are lined up and represent sections of a hard drive where data can be saved. The first three squares are empty, the next seven squares contain the data for a book report and are colored green, and the final two squares are empty. Data for files do not necessarily have to be saved in clusters that are physically next to each other, but they are in this example.
Figure 1. Files, like this book report, are stored in multiple clusters on the hard drive. Clusters next to a file can be empty or filled with a different file. As a side note, the clusters that store a file do not all have to be physically next to each other.
If you select a file and press the delete button, the file will go in to a folder marked Trash if you are using a Mac, or marked Recycle Bin if you are using a Windows computer. Emptying the Trash/Recycle Bin (if you do not know how to do this, ask an adult who is comfortable using computers or do an internet search on "how to empty my computer's Trash/Recycle Bin") tells the computer to get rid of the table entry that says what the file is called and where it is stored on the hard drive. It also signals to the computer to think of those hard drive clusters as "empty" again, even though there is information sitting in them.
Once the computer thinks of the hard drive clusters as "empty," it can store other files in those spaces by writing over the information that was previously in them. Figure 2 shows an example of this; once the book report was deleted, the computer could store other files in the same space. Notice that not all of the clusters are written over. This is a matter of luck. If a smaller file like the photo in the example shown in Figure 2 is stored in the same space a larger file, like the book report, used to take up, several of the clusters next to it may not be overwritten.
Image Credit: Sandra Slutz, Science Buddies / Science BuddiesTwelve squares represent areas on a hard drive where data can be saved. When a file is deleted, the data in the square isn't erased but it is allowed to be over-written with new data. In this example the first three squares contain data for a science fair data table, the next seven squares used to be all green and contain the data for a book report but now two squares are green. Two squares after that are yellow and hold data for photos, the next square is green and a remenant of the deleted book report. The final four squares are blue and contain the data for a video game. Only some sections of the book report have been over-written but the clusters that weren't needed for new data are still green and contain data for the deleted book report.
Figure 2. Once a file is deleted, the file system manager allows the hard drive clusters to be overwritten with new files.
Using data recovery tools that look at whether a hard drive cluster is truly empty or not, forensic computer analysts can sometimes retrieve all or parts of a file if it has not been written over. You will try this yourself using free data recovery tools for this science project.
Sometimes people deliberately write over a file to keep the data secret. This is called overwriting or file shredding, and there are tools to do this too (you will investigate some of them during your project). Do you think it is possible to recover these files?
With the help of an adult who knows how to use the computer, and permission from the computer's owner, you will compare how much effort it takes to find saved, trashed, deleted, and shredded files. Which of these do you think you will be able to find? How long do you think it will take you? Good luck searching!
Terms and Concepts
- Forensic computer analyst
- Hard-disk drive
- Hard-disk drive clusters
- Deleting a file
- Data recovery
- Overwriting files
- File shredding
- Operating system
- File extension
Questions
- What are a person's expectations when they say they have deleted a file?
- How are files stored on a hard disk drive? What happens when you delete a file by emptying the Trash/Recycle Bin on a Windows or Mac operating system?
- What does a file recovery tool do and how does it work?
- Under what conditions could a file not be recovered?
Bibliography
This website is a good place to look up computer terms like hard drive, delete, trash, and overwrite.
- Christensson, Per. (n.d.) The Tech Terms Computer Dictionary. Retrieved December 2, 2016.
More information about storing, deleting, and recovering files can be found in these resources:
- How To Geek Contributors. (2015, September 29). Why Deleted Files Can Be Recovered, and How You Can Prevent It. Retrieved December 2, 2016.
- Powell, Oliver. (2015, May 6). What is Data Recovery and How It Is Helpful for You?. Retrieved December 2, 2016.
For help creating graphs, try this website:
- National Center for Education Statistics, (n.d.). Create a Graph. Retrieved June 25, 2020.
Materials and Equipment
- Computer with a hard-disk drive; you must have the owner's permission to make files, delete them, search the computer, and install software. Note: A solid state drive will not work for this project. Solid state drives are a different technology and do not deal with deleting data in the same way.
- Mac or Windows operating system; if you want to use a computer with a Chrome operating system, you will have to adapt the experimental procedure yourself. Chrome operating system does not have a trash/recycle option.
- Adult helper who is comfortable using the computer
- Lab notebook
Experimental Procedure
Choosing Your Tools
To do this project, you need to find the tools to do three different things on the computer: search for a file, overwrite a deleted file (sometimes called shredding a file), and recover a deleted file. Before starting, make sure you have the computer owner's permission to do all of these things on the computer!
- The computer's operating system should come with search tools for finding files. Make sure you know how to use them to find a file on the computer's hard drive and in the computer's Trash (Mac) or Recycle Bin (Windows).
- If you do not know how to search for files, ask an adult to teach you or search for instructions online. If you are searching for instructions, make sure to be specific about which operating system you are using. For example: "how to search for a file in Windows 10" or "how to search for a file in Mac OS X."
- Practice making and finding files on the computer.
- If you do not already have a file recovery tool on your computer, you will need to find one, download it, and install it.
- Like search tools, file recovery software is usually specific to your operating system. There are several free programs for Mac and Windows; a simple online search for "free file recovery programs for [your operating system]" can give you several options. Two options to get you started are Recuva for Windows and MiniTool Mac Data Recovery.
- Once you have selected a tool, downloaded, and installed it, practice recovering some files. Start by making and saving a few text files (text files have .txt extensions and can be made using word processor programs like Microsoft Word or simpler programs like Notepad), deleting them, emptying the computer's trash/recycle bin and then recovering the files with the software.
- Lastly you will need to find, download, and install a file shredding program on the computer. Search for a free tool for your computer's operating system online, or read this how-to article for Mac and try Eraser for Windows.
- Your adult helper will be the one shredding files. Make sure they are comfortable using the software.
Preparing the Files
An adult helper who is comfortable with the computer needs to prepare the files for you. If you did it yourself, you would know where the files are and it would be impossible to do the rest of the project. Have your adult helper follow the instructions in this PDF. If you are a student, do not open the PDF until after you are done collecting all your data.
Collecting Your Data
Once your adult helper has followed all the instructions in the Preparing the Files section and created the files on your computer, you are ready to collect your science project data. Your goal is to search for each of the files listed in Table 1 and rate how difficult it was to find each one.
- Decide which file from Table 1 you are trying to find.
- Search the computer for the file. The file should have a .txt extension.
- First look on the computer's hard drive using the operating system's search tool. If you find the file, note that in Table 1 and write "very easy" in the File Recovery Difficulty Level column.
- If you do not find the file in the hard drive, try searching the Trash/Recycling Bin. If you find the file, note that in Table 1 and write "easy" in the File Recovery Difficulty Level column.
- If you cannot find the file anywhere on the computer, try running the file recovery tool and searching for it among the recovered files. If you find the file, note that in Table 1 and write "medium" in the File Recovery Difficulty Level column.
- If you still cannot find the file and are ready to give up looking, note that in Table 1 and put "hard" in the File Recovery Difficulty Level column.
| File Name | File Found (yes/no) | File Recovery Difficulty Level | Text in File | File Treatment |
|---|---|---|---|---|
| Chicken scratch | ||||
| Disguised | ||||
| Easter egg | ||||
| Fairy dust | ||||
| False diary | ||||
| Kittens | ||||
| Presents | ||||
| Puppies | ||||
| Secrets | ||||
| Surprise | ||||
| Unknown | ||||
| Your gift |
- If you do find the file, also record what the text was in the file.
- Repeat steps 1-4 for each of the 12 files. When you have as many found of the 12 files as you can, download and open the adult helper PDF.
- For each file you found, check to see if the text in the file you found matches the text that was supposed to be in the file. If it does match, you can be sure you have found the right file. If it does not match, check with your adult helper—you may not have found the file!
- If you found the wrong file, you will need to go back and keep trying to find the right one. Make sure to update your data table as needed.
- Copy the file treatments (saved, trashed, deleted, or overwritten) for all 12 of the files from the adult helper PDF in to your data table.
Analyzing Your Data
- Make a summary table of your data like Table 2.
- Look at the data from just the files in the "saved" file treatment group. Calculate how many of the files you found in that treatment. The minimum number should be 0 and the maximum number should be 3.
- Convert the File Recovery Difficulty Levels in Table 1 from words to numbers. Then calculate the Average Difficulty Level for the "saved" file treatment group.
- Very easy should be a difficulty level of 1.
- Easy should be a difficulty level of 2.
- Medium should be a difficulty level of 3.
- Hard should be a difficulty level of 4.
- Repeat steps a-b for the other three file treatment groups: trashed, deleted, and overwritten.
| File Treatment Group | Number of Files Found | Average Difficulty Level |
| Saved: file was saved to computer's hard drive | ||
| Trashed: saved file was moved to the computer's trash | ||
| Deleted: saved file was moved to computer's trash, then trash was emptied | ||
| Overwritten: a program was used to write over the deleted file |
- Make a bar graph of the Number of Files Found.
- You can do this by hand on graph paper, use a spreadsheet program like Excel, or use an online graph making tool like Create a Graph.
- Label the y-axis Number of Files Found. Label the x-axis File Treatment Group and make sure each bar is clearly labeled as data from the saved, deleted, trashed, or overwritten treatment groups.
- Make a similar bar graph of the Average Difficulty Level.
Making Your Conclusions
- Now that all your data is summarized in front of you, look at it carefully and figure out what conclusions you can make from your experiment.
- What does your data tell you about what actions are required to make a computer file truly gone?
- How much effort does it take to find a file on a computer? How does trashing that file, deleting it by emptying the trash, or overwriting it change the amount of effort needed to read the text in the file?
Ask an Expert
Global Connections
The United Nations Sustainable Development Goals (UNSDGs) are a blueprint to achieve a better and more sustainable future for all.
Variations
- Try deleting (putting in the Trash/Recycle Bin then emptying it) larger word document files with a lot of text and images. Make sure the files are several MB large. Then use the computer to create and save other files for one day, several days, or even several weeks. How easy is it to recover the deleted files? How does changing the amount of computer use between when the files were deleted and recovered change whether or not the file can be recovered and the quality of the data recovered from the file?
- Have you ever heard someone say that a computer's hard drive is fragmented? Read up on hard drive fragmentation to figure out how saving and deleting files might change how fragmented a hard drive is. Can you devise a test to look at the relationship between saving and deleting files and disk fragmentation?
Careers
If you like this project, you might enjoy exploring these related careers:
Related Links
- Science Fair Project Guide
- Other Ideas Like This
- Computer Science Project Ideas
- Cybersecurity Project Ideas
- My Favorites
