How does an OS delete data? (Linux / Windows) [closed]

My question is simple: How does the operating system (Linux or Windows) delete data from my HDD?

I can imagine two ways:

1. 'physical way': Really delete the data by putting the memory adresses of the data all to zero. For example if somewhere on my HDD the data looks like 1010...010 afterwards it will look like 0000...000

2. Keep the data but allow to overwrite it.

Solution 1:

Talking about "data" is too broad, but it's pretty obvious you are actually talking about files. You need to be aware that files are usually stored in filesystems. Although there are differences, this generally means there's a tree structure of paths, representing either files or directories, and files are assigned space on the hard disks where its contents are stored.

Commands such as rm simply remove the file, i.e. the entry in the tree: they mark the parent directory as having one less child. At the address where the file was, and where the file's contents were, nothing changes.

However, there are also commands such as shred, which actually overwrite the file's contents, so that it (ideally) can't be restored. This is actually harder than the former, because it's not guaranteed that the same sectors are used for storing the overwriting data, and because physically, the magnetic data on the disk is not simply binary. Also, such tools do not simply zero out the data but overwrite it multiple times with patterns or random data, to make it physically harder to restore.

So, there are both options you mentioned, but the everyday deletion is simply removing the pointer to the actual data.

Solution 2:

You've pretty much answered your own question. When the OS deletes it marks the space used by the file as "re-usable". More secure "deletes" will overwrite the file blocks. This is also the same with "quick" and "full" disk formats

Solution 3:

The second way. The filesystem on your hardrive has a master file table, this is a basically an index that tells which sector holds which file. If a file is deleted then the entry is erased from that table and the sectors can be used for new files. The old data is still there, and can be recovered unless it gets overwritten.