Why is 'deleted' data often still recoverable?

The everyday meaning of "delete" — it's gone — is the trap. Candidates assume removal equals destruction. The interviewer wants the mental model of how filesystems actually free space, because that model underpins both forensics and secure disposal.

What "delete" really does

A filesystem tracks files with metadata: a directory entry plus a record (inode, MFT entry, etc.) that points at the data blocks. When you delete a file, the OS typically just unlinks that pointer and flags the underlying blocks as available for reuse. It does not scrub the blocks. The original bytes sit there, intact, until the OS later allocates those same blocks for a different file and writes over them. Until that moment, the data is remanent.

Why recovery works

Two techniques exploit this. If the metadata is still partly present, undelete tools relink it. If the metadata is gone, file carving scans the raw disk for known file signatures (headers/footers, like a JPEG's magic bytes) and reconstructs files with no filesystem help at all. This is routine in DFIR — and a real risk when disposing of media.

The nuances worth mentioning

• SSDs complicate this: TRIM and wear-leveling mean the controller may proactively erase or relocate blocks, so behaviour differs from spinning disks.
• Secure deletion means overwriting the data (or, more reliably, cryptographic erasure — destroying the encryption key so the ciphertext is unrecoverable).

What interviewers look for

The pointer-versus-data distinction, the phrase "until it's overwritten," and ideally mention of carving plus why SSD/encryption changes the picture. That shows forensic intuition, not folk belief.