WEBVTT - Gone Baby Gone - The Deleted Story 0:00:04.160 --> 0:00:07.760 Get in text with technology with tech Stuff from works 0:00:07.800 --> 0:00:14.440 dot com. Hey there, and welcome to tex Stuff. I'm 0:00:14.520 --> 0:00:18.439 your host, Jonathan Strickland. I'm also an executive producer at 0:00:18.520 --> 0:00:21.960 how Stuff Works, and I love all things tech and 0:00:22.079 --> 0:00:25.680 recently I had a request from a listener. The listener 0:00:25.720 --> 0:00:29.320 asked me about doing an episode about data retrieval. Now, specifically, 0:00:29.960 --> 0:00:32.800 this listener was curious about how you go about retrieving 0:00:32.920 --> 0:00:36.320 data that was marked for deletion, and this curiosity was 0:00:36.360 --> 0:00:41.240 sparked by news stories of various agencies following investigations and 0:00:41.520 --> 0:00:44.600 trying to look for evidence of deleted materials. So the 0:00:44.680 --> 0:00:46.400 listener asked if I might be able to go into 0:00:46.400 --> 0:00:51.040 that without it becoming a political discussion. Right, Uh, And 0:00:51.159 --> 0:00:57.120 I completely respect that. I definitely have a very particular 0:00:57.160 --> 0:01:01.640 political philosophy, but I also acknowledge that these sort of 0:01:01.680 --> 0:01:05.720 investigations can happen to any political side of the spectrum. Right, 0:01:05.760 --> 0:01:10.399 It's not a specific problem that involves one side or 0:01:10.480 --> 0:01:14.320 the other. Everyone, at some point or another has been 0:01:14.319 --> 0:01:16.440 involved in this kind of stuff. Everyone by that, I 0:01:16.480 --> 0:01:19.840 mean all the major political parties, and that there's always 0:01:19.880 --> 0:01:23.440 some sort of question about an investigation. And then well, 0:01:23.760 --> 0:01:27.080 did they have possession of information and then they willingly 0:01:27.160 --> 0:01:30.240 got rid of that information or they worked to delete it, 0:01:30.640 --> 0:01:33.160 and if so, how do you go about retrieving that? 0:01:33.440 --> 0:01:36.520 So this goes well beyond politics. By the way, politics 0:01:36.640 --> 0:01:40.560 is an obvious example of how this happens. But you 0:01:40.640 --> 0:01:43.920 also hear about these investigations into big corporations that involve 0:01:43.959 --> 0:01:46.720 trying to retrieve data from the void. I mean, this 0:01:46.800 --> 0:01:51.640 goes back ancient times, really, but if in modern era 0:01:51.720 --> 0:01:54.200 it goes back to before you're talking about hard drives 0:01:54.200 --> 0:01:57.360 and things like shredded documents and stuff. I remember in 0:01:57.560 --> 0:02:01.160 the late nineties early two thousand's when there were a 0:02:01.160 --> 0:02:03.960 lot of stories about this, like if you really want 0:02:03.960 --> 0:02:05.760 a good one, you can read up on en Ron. 0:02:06.120 --> 0:02:09.520 But in that era, when you have an investigation and 0:02:09.560 --> 0:02:13.000 they're looking for evidence, what steps do you have to take? 0:02:13.240 --> 0:02:15.800 Or if you're looking at the other way, if you 0:02:15.880 --> 0:02:19.080 have a device that's got data on it and you 0:02:19.120 --> 0:02:21.480 want to get rid of that device for whatever reason, 0:02:21.520 --> 0:02:25.600 how can you be sure, absolutely certain that your information 0:02:25.680 --> 0:02:28.440 is no longer on that device. That's what we're gonna 0:02:28.480 --> 0:02:32.040 talk about today. So what happens when you mark a 0:02:32.040 --> 0:02:35.959 file for deletion? How does that file actually go through 0:02:36.240 --> 0:02:39.760 the deletion process, and to what extent can that file 0:02:39.840 --> 0:02:43.000 then be recovered. Long time listeners of tech stuff may 0:02:43.040 --> 0:02:47.080 remember that I've done an episode similar to this particular 0:02:47.120 --> 0:02:49.799 one in the past, But things have changed a bit 0:02:49.880 --> 0:02:52.640 since that last episode. In fact, the big one would 0:02:52.639 --> 0:02:55.920 be that cloud computing and cloud storage has become a 0:02:56.000 --> 0:02:59.960 major industry and it's really changed the conversation as well, 0:03:00.400 --> 0:03:03.280 because now we have other stuff to worry about, not 0:03:03.400 --> 0:03:06.360 just the the devices that are in your possession, but 0:03:06.840 --> 0:03:10.680 the places where data could exist outside of your control. 0:03:10.800 --> 0:03:13.120 So how does that change things? The answer to that 0:03:13.240 --> 0:03:16.520 is a lot. Well, first, let's talk about what happens 0:03:16.600 --> 0:03:19.880 when you actually delete a file on a device you own. 0:03:20.400 --> 0:03:23.000 So you've decided to free up some space on a 0:03:23.080 --> 0:03:25.160 hard drive on a computer, and I'm talking about a 0:03:25.200 --> 0:03:29.239 physical hard drive here. You're going to delete a folder 0:03:29.320 --> 0:03:32.600 that contains old term papers because you're never going to 0:03:32.680 --> 0:03:34.880 need those again, let's be honest, there's no reason to 0:03:34.960 --> 0:03:38.640 keep them. And what is happening behind the scenes when 0:03:38.680 --> 0:03:42.560 you mark those documents for deletion, Well, the particulars depend 0:03:42.640 --> 0:03:45.640 upon the device you're using. So, for example, if you're 0:03:45.640 --> 0:03:49.240 on a Windows PC, you're following the rules dictated by 0:03:49.280 --> 0:03:52.840 the nt f S file system. Now in t f 0:03:53.040 --> 0:03:56.680 S stands for New Technology File System, I guess that 0:03:56.720 --> 0:04:00.080 means I just said new Technology file system files is 0:04:00.120 --> 0:04:03.600 them kind of like pen number or a t M machine. 0:04:03.680 --> 0:04:06.839 So whoop see daisy on that one, guys. Anyway, when 0:04:06.840 --> 0:04:09.760 you delete a file, the file pops on over to 0:04:09.800 --> 0:04:13.080 the recycle bin or the trash bin, depending upon what 0:04:13.200 --> 0:04:16.000 operating system you're using. But the principle remains the same. 0:04:16.040 --> 0:04:18.080 And when I say pops on over, the file doesn't 0:04:18.080 --> 0:04:23.360 actually change locations on the hard drive. It's designation changes. 0:04:23.800 --> 0:04:27.280 So instead of the file being listed as being inside 0:04:27.279 --> 0:04:31.120 the docks folder, it's being listed in the recycle bin. 0:04:31.279 --> 0:04:35.919 So the physical location of data on your computer is 0:04:36.000 --> 0:04:42.240 not tied directly to its file location. Within a file directory, 0:04:42.520 --> 0:04:45.560 those two things are separate. The file directory gives us 0:04:45.560 --> 0:04:48.280 a very convenient way for human beings to look at 0:04:48.320 --> 0:04:51.440 all the information that's stored on a device, or at 0:04:51.480 --> 0:04:54.280 least all the information that is viewable. Sometimes you have 0:04:54.360 --> 0:04:57.719 hidden files that won't show up in a file directory. 0:04:58.600 --> 0:05:01.640 But let's just for argument's sake, say all the files. 0:05:02.080 --> 0:05:04.200 It's an easy way to organize that so that we 0:05:04.320 --> 0:05:07.520 as human beings can find what we're looking for. If 0:05:07.640 --> 0:05:10.800 it were just a giant storage bend that had data 0:05:10.960 --> 0:05:14.960 kind of haphazardly connected inside of it, it would be 0:05:15.040 --> 0:05:18.000 very difficult to find anything specific you wanted. So the 0:05:18.000 --> 0:05:22.000 file system is mainly meant as something to let us 0:05:22.160 --> 0:05:27.039 humans access our information more easily. It's not so much 0:05:27.040 --> 0:05:30.080 for the computer. It's for us on the physical side. 0:05:30.360 --> 0:05:34.080 That data could be located next to data that's in 0:05:34.120 --> 0:05:37.160 a totally different file folder, in a totally different section, 0:05:37.240 --> 0:05:41.839 even in a different drive on your computer. So that's 0:05:41.880 --> 0:05:43.880 something to keep in mind. The physical location of your 0:05:43.960 --> 0:05:49.159 data and the files location are not necessarily connected. That's 0:05:49.160 --> 0:05:52.680 important to remember. But the file designation has changed, so 0:05:52.760 --> 0:05:56.880 the associated programs with that file will no longer connect 0:05:56.960 --> 0:05:59.240 to it. By that, I mean, let's say it's a 0:05:59.279 --> 0:06:02.000 word document. I had mentioned term papers earlier, so you've 0:06:02.000 --> 0:06:04.600 got a term paper. It's a word document. Let's say 0:06:04.640 --> 0:06:07.680 you used a Microsoft word and you save the document there, 0:06:08.279 --> 0:06:10.720 and when you delete it, it means that the file 0:06:10.800 --> 0:06:14.159 designation changes so that that file is now appearing in 0:06:14.200 --> 0:06:17.400 the recycled bin as opposed to the documents folder and 0:06:17.480 --> 0:06:19.240 you pull up Word and you want to pull up 0:06:19.279 --> 0:06:23.560 that particular document, you can't because it's trying to connect 0:06:23.720 --> 0:06:26.520 to a file that was last in the documents folder. 0:06:26.680 --> 0:06:30.000 That's not where it is anymore. So Word is not 0:06:30.040 --> 0:06:32.200 going to find that anymore. It's it's kind of the 0:06:32.240 --> 0:06:35.680 first step to saying this file is gone, but the 0:06:35.680 --> 0:06:39.440 file is not really gone. It's over in that recycle bin. 0:06:39.560 --> 0:06:41.560 Like you could actually open up the recycle bin and 0:06:41.600 --> 0:06:43.599 see the files that are inside of it, assuming you 0:06:43.600 --> 0:06:47.320 don't have your recycle bin set to auto delete as 0:06:47.360 --> 0:06:50.159 soon as something goes into it. Uh. It means that 0:06:50.240 --> 0:06:52.760 you actually have a bit of a safety net, which 0:06:52.800 --> 0:06:55.000 is a good thing, right, because sometimes you might select 0:06:55.000 --> 0:06:57.520 a file to delete and it turns out, whoop, see Daisy, 0:06:57.560 --> 0:06:59.719 I did not mean to actually delete that. That was 0:06:59.720 --> 0:07:01.240 a pick you're of my niece, and I want to 0:07:01.320 --> 0:07:04.840 keep it forever and ever. So you could go into 0:07:04.880 --> 0:07:08.080 a recycle bin or a trash bin and restore a file. 0:07:08.720 --> 0:07:12.120 And that's kind of a nice little way to rescue 0:07:12.200 --> 0:07:16.440 something when you you make just a human mistake. Uh. 0:07:16.440 --> 0:07:21.600 And thankfully it does exist, because I have certainly use 0:07:21.720 --> 0:07:25.520 that more than once where I've realized that I accidentally 0:07:25.520 --> 0:07:27.680 sent the wrong file to delete, and so I go 0:07:27.760 --> 0:07:31.080 into the recycled bin and restore it. But what happens 0:07:31.080 --> 0:07:34.400 if you choose to empty your recycle bin, because that's 0:07:34.440 --> 0:07:37.800 typically something that you are allowed to do. You might 0:07:37.880 --> 0:07:42.000 have it set to automatically empty every certain incremental amount 0:07:42.000 --> 0:07:45.480 of time, or it may just be totally manual, uh, 0:07:46.040 --> 0:07:48.520 And which case, it's whenever you go in there, or 0:07:48.560 --> 0:07:51.560 if you hit a certain threshold of data, like if 0:07:51.600 --> 0:07:53.800 there's a certain amount of data in the recycle bin, 0:07:53.880 --> 0:07:58.280 it may auto empty once it hits that threshold. But 0:07:58.360 --> 0:08:01.520 however you choose to do it, what happens when that 0:08:01.560 --> 0:08:05.440 recycle bin is emptied. Is the file totally gone? Then no, 0:08:05.920 --> 0:08:09.240 it's not at that point. What happens behind the scenes again, 0:08:09.320 --> 0:08:12.520 is the operating system removes the file name entry from 0:08:12.560 --> 0:08:15.720 the file system. So now you can't even find it 0:08:15.800 --> 0:08:18.640 within the recycle ben. There's no account of it in 0:08:18.680 --> 0:08:22.880 the file system itself. But the physical space on your 0:08:22.880 --> 0:08:25.360 hard drive, because remember we're talking about a physical hard 0:08:25.440 --> 0:08:29.680 drive example here, the physical space that that file occupies 0:08:30.440 --> 0:08:32.520 still has the file in it. It's just that that 0:08:32.679 --> 0:08:37.160 space is marked as being free or freely available, but 0:08:38.200 --> 0:08:41.400 there's actually still the file, the information, the zeros and ones, 0:08:41.440 --> 0:08:45.280 they're all still right there. They haven't disappeared. So this 0:08:45.360 --> 0:08:48.079 means that the computer is free to write over that 0:08:48.160 --> 0:08:52.080 section of the hard drive space. It doesn't mean it 0:08:52.160 --> 0:08:55.360 will right away, but it could. It might happen immediately, 0:08:55.679 --> 0:08:58.360 or it might happen months later, or it might not 0:08:58.480 --> 0:09:01.280 happen at all. So if you lead a file and 0:09:01.720 --> 0:09:03.400 a few months later you decide to get rid of 0:09:03.400 --> 0:09:06.520 your computer, the traces of that file may still be 0:09:06.600 --> 0:09:11.559 on that hard drive. All the deletion means is saying, hey, computer, 0:09:11.800 --> 0:09:15.280 if you need this space to store something, it's totally available, 0:09:15.320 --> 0:09:17.760 so just go ahead and move on in. But in 0:09:17.800 --> 0:09:20.839 the meantime, I'm just gonna hold this old information that's 0:09:20.840 --> 0:09:24.560 sitting here because it's not really relevant to anything anymore. 0:09:25.280 --> 0:09:28.280 Um So, that free designation only means that the file 0:09:28.320 --> 0:09:32.200 space is available, not that it is actually empty. So 0:09:32.240 --> 0:09:34.800 if you delete a file from your computer and you 0:09:34.840 --> 0:09:37.440 empty the recycled bin, the information will still be on 0:09:37.480 --> 0:09:40.160 the storage device, and as you save more information to 0:09:40.200 --> 0:09:43.360 the computer, the operating system has the option of storing 0:09:43.400 --> 0:09:47.199 that new information by writing over the old info represented 0:09:47.200 --> 0:09:49.960 by the deleted file. At that point, when you have 0:09:50.000 --> 0:09:53.680 a new file in place, you've effectively erased at least 0:09:53.720 --> 0:09:57.200 part of the old information. So let's say we're using 0:09:57.240 --> 0:10:00.800 that term paper example again, and you end up getting 0:10:00.840 --> 0:10:03.360 a game because of course you wanted to free up 0:10:03.400 --> 0:10:05.920 computer space on your computer to install a new game 0:10:05.960 --> 0:10:08.920 on it, right, And when you install it, it starts 0:10:08.960 --> 0:10:11.480 to write the data to the hard drive, and part 0:10:11.600 --> 0:10:14.520 of the the section of the hard drive it writes 0:10:14.600 --> 0:10:17.840 over happens to be part that held that term paper. 0:10:18.360 --> 0:10:21.400 Now your term paper is a race because the hard 0:10:21.480 --> 0:10:25.360 drive has been altered so that new data is on 0:10:25.480 --> 0:10:28.320 top of what used to be old data, not really 0:10:28.320 --> 0:10:31.800 on top replaces. It replaces the old data, which means 0:10:31.800 --> 0:10:33.439 the old data is gone, or at least part of 0:10:33.480 --> 0:10:35.760 it's gone. You know. It all depends on where in 0:10:35.800 --> 0:10:40.160 the physical space that reallocation happens. So you could have 0:10:40.440 --> 0:10:42.560 a tiny bit of the term paper left. It would 0:10:42.559 --> 0:10:45.640 probably be meaningless bits at that point because you wouldn't 0:10:45.640 --> 0:10:48.800 necessarily have any of the information related to what type 0:10:48.800 --> 0:10:51.120 of file it used to be, but there might still 0:10:51.160 --> 0:10:53.120 be some zeros and ones that used to belong to 0:10:53.160 --> 0:10:55.840 that term paper on that hard drive, but for the 0:10:55.840 --> 0:10:59.040 most part it would be erased gone because you have 0:10:59.120 --> 0:11:03.440 new information takeing up that same physical space. Now, once 0:11:04.320 --> 0:11:08.000 you've done all this, you won't be able to retrieve 0:11:08.400 --> 0:11:12.360 a deleted file easily. Right once you set that recycle 0:11:12.480 --> 0:11:15.440 bin too empty, the operating system will no longer be 0:11:15.480 --> 0:11:18.120 able to identify that marked file in your system. So 0:11:18.160 --> 0:11:21.680 even though it may physically still exist on the hard drive, 0:11:22.240 --> 0:11:26.520 there's no record of its existence in the software side, 0:11:27.000 --> 0:11:30.760 right like there's no there's no map to that destination anymore. 0:11:31.120 --> 0:11:33.920 So the destination may still exist, but you don't know 0:11:33.960 --> 0:11:36.400 how to get there. This is when you would have 0:11:36.480 --> 0:11:39.640 to bring a device to perhaps a service or use 0:11:39.679 --> 0:11:45.560 special software to search for that information and potentially retrieve it. Now, 0:11:45.720 --> 0:11:47.640 there's no guarantee that you're going to be able to 0:11:47.679 --> 0:11:51.280 retrieve a deleted file, particularly if you've continued to use 0:11:51.320 --> 0:11:54.920 that same device for a good amount of time afterward, 0:11:55.000 --> 0:11:59.280 because that increases the chances that you've overwritten that old information. 0:11:59.760 --> 0:12:03.880 But assuming that you haven't, you could potentially retrieve all 0:12:03.920 --> 0:12:08.160 sorts of old data. And uh, again, it all really 0:12:08.160 --> 0:12:10.640 depends on how much use you've got to that machine 0:12:10.640 --> 0:12:13.800 and how frequently you're writing data to it. If it's 0:12:13.840 --> 0:12:16.320 not frequent, then there's a better chance that you'll be 0:12:16.320 --> 0:12:19.640 able to retrieve at least some of that information. Now, 0:12:19.679 --> 0:12:22.240 in some ways that's great news, but say you've got 0:12:22.280 --> 0:12:25.160 a computer that had files marked for deletion and later 0:12:25.240 --> 0:12:28.880 on you find out that you actually need those files. Uh, 0:12:28.920 --> 0:12:31.280 if you are quick enough, and if you're lucky enough, 0:12:31.559 --> 0:12:34.280 you may be able to retrieve some or potentially even 0:12:34.360 --> 0:12:38.320 all of that data using data retrieval tools. And it 0:12:38.400 --> 0:12:41.440 could also mean that if your computer had suffered some damage. 0:12:41.760 --> 0:12:43.880 Let's say that you weren't trying to delete files at all, 0:12:43.960 --> 0:12:46.600 but your computer has suffered damage that has made it 0:12:46.640 --> 0:12:50.360 impossible to access the hard drive. This also means that 0:12:50.400 --> 0:12:53.040 you could potentially take a hard drive to one of 0:12:53.040 --> 0:12:56.920 these data retrieval services and get information that otherwise would 0:12:56.920 --> 0:12:59.240 be inaccessible to you. I'll talk more about that a 0:12:59.280 --> 0:13:01.240 little bit later in the podcast, because there are some 0:13:02.080 --> 0:13:07.320 really phenomenal stories about data retrieval in extreme circumstances that 0:13:07.520 --> 0:13:09.960 blew my mind when I heard about them. But in 0:13:10.000 --> 0:13:12.199 other ways, this is not such a good thing. It's 0:13:12.200 --> 0:13:16.280 actually a bad thing, because if you've brought let's say 0:13:16.360 --> 0:13:17.640 let's let's say you go out and you get a 0:13:17.640 --> 0:13:20.600 brand new computer. You've got an old one that you've 0:13:20.600 --> 0:13:22.320 been using for a while and it's time to upgrade. 0:13:22.320 --> 0:13:23.720 So you go out and you buy a new computer, 0:13:24.520 --> 0:13:25.800 and then you think, well, what do I do with 0:13:25.800 --> 0:13:27.600 this old computer? I don't need it, I'm not going 0:13:27.640 --> 0:13:29.520 to use it, so maybe I want to sell it, 0:13:29.640 --> 0:13:32.240 or maybe I want to donate it. Well, if you're 0:13:32.280 --> 0:13:34.960 going to do that, you're really gonna want to get 0:13:35.080 --> 0:13:38.880 rid of any personal information, any data that's sensitive on 0:13:38.920 --> 0:13:40.719 that machine. You want to get rid of that as 0:13:40.760 --> 0:13:43.600 best you can before you hand it over to someone 0:13:43.640 --> 0:13:49.160 else who could potentially exploit that information. So you may 0:13:49.280 --> 0:13:53.080 want to figure out a way of wiping it off 0:13:53.080 --> 0:13:57.120 for good. And one thing you could do is run 0:13:57.160 --> 0:14:01.200 a third party program or application that will guarantee that 0:14:01.280 --> 0:14:04.760 it will delete all of the info on your machine. 0:14:05.200 --> 0:14:07.680 It does this, by the way, by not just marking 0:14:07.679 --> 0:14:12.000 it for deletion, but then writing random data to the drive, 0:14:12.320 --> 0:14:17.679 so just meaningless gibberish. In other words, over all that 0:14:18.160 --> 0:14:22.240 space that was marked for deletion, typically it maybe the 0:14:22.440 --> 0:14:25.800 entire drive. Like there are a lot of of options 0:14:25.840 --> 0:14:30.240 where you know, there's no subtlety here. It's wipe everything others. 0:14:30.280 --> 0:14:33.840 It may be designated parts of a drive, like specific folders. 0:14:33.920 --> 0:14:37.840 Sometimes it may be partitions. If you create different partitions 0:14:37.840 --> 0:14:40.160 of your hard drive, you might be able to target 0:14:40.240 --> 0:14:44.720 a specific partition over others. But my advice is if 0:14:44.760 --> 0:14:46.840 you're using one of these, just use it with the 0:14:46.920 --> 0:14:51.280 assumption that it's going to hit everything, which means, before 0:14:51.360 --> 0:14:53.840 you do this, if you have anything on that machine 0:14:53.880 --> 0:14:56.800 that you want to keep, back up your hard drive. 0:14:57.280 --> 0:14:58.840 I know that seems weird if you're going to get 0:14:58.920 --> 0:15:02.320 rid of everything anyway but back it up. You should 0:15:02.320 --> 0:15:06.120 be backing up your hard drives anyway because stuff goes 0:15:06.160 --> 0:15:09.520 wrong and occasionally you just need to get access to 0:15:09.600 --> 0:15:12.480 old stuff, and if you don't back it up, it 0:15:12.560 --> 0:15:17.040 can make that much more difficult and expensive. These services 0:15:17.080 --> 0:15:20.920 that do data retrieval can sometimes be pretty costly, depending 0:15:20.960 --> 0:15:25.640 upon how extensive the problem is. So if you do 0:15:25.840 --> 0:15:28.880 use one of these services to rewrite data over a 0:15:28.960 --> 0:15:33.520 physical hard drive, it takes time. You know, this is 0:15:33.760 --> 0:15:38.120 a hard drive that uses platters, and that means also 0:15:38.280 --> 0:15:41.760 that this particular approach creates wear and tear on your device. 0:15:42.120 --> 0:15:44.280 So let me elaborate on that, like how how can 0:15:44.320 --> 0:15:47.640 this actually create wear and tear on a hard drive? Well, 0:15:47.680 --> 0:15:51.000 the hard drive is the data storage space on a computer, right, 0:15:51.000 --> 0:15:54.200 This is your data repository. This is the thing that 0:15:54.280 --> 0:15:58.280 can hold information indefinitely, even after power is cut off 0:15:58.320 --> 0:16:02.600 to the computer, that it remains there. It is stable 0:16:02.800 --> 0:16:06.840 from between power cycles. So it's not like RAM random 0:16:06.880 --> 0:16:09.960 axis memory, which only exists for as long as the 0:16:09.960 --> 0:16:14.600 computer receives power. This is semi permanent right until you 0:16:14.680 --> 0:16:21.440 markt for deletion. The old physical addresses are stored information 0:16:21.680 --> 0:16:25.960 using magnetism. In other words, you're using magnets to create 0:16:26.560 --> 0:16:30.240 the zeros and ones on these platters. It can hold 0:16:30.240 --> 0:16:33.880 this information indefinitely. These hard drives have a circular plate 0:16:33.880 --> 0:16:36.480 in them. That's what is the platter. So the platter 0:16:36.520 --> 0:16:40.240 is a circular plate. They're shiny, and they're at least 0:16:40.280 --> 0:16:45.400 coded in magnetic material. Most hard drive platters tend to 0:16:45.400 --> 0:16:48.760 be made out of either glass or aluminum, and then 0:16:48.760 --> 0:16:51.160 they're coated with a layer of metal that can be 0:16:51.240 --> 0:16:57.120 magnetized and demagnetized. The platter surface contains billions of tiny 0:16:57.200 --> 0:17:01.520 little areas individually distinct from another, and every single one 0:17:01.560 --> 0:17:04.560 of those billions of areas can be magnetized, which would 0:17:04.600 --> 0:17:08.840 represent the number one in binary, or demagnetized, which would 0:17:08.880 --> 0:17:12.240 represent the number zero. Now, using ones and zeros, you 0:17:12.280 --> 0:17:15.399 can represent all sorts of data, but it takes a 0:17:15.440 --> 0:17:18.320 lot of zeros and ones to represent a relatively small 0:17:18.359 --> 0:17:21.560 amount of information. So, for example, if you wanted to 0:17:21.600 --> 0:17:25.320 create the binary for an upper case A, you would 0:17:25.400 --> 0:17:31.359 use the eight digits of zero one zero, zero, zero 0:17:31.480 --> 0:17:34.479 zero zero one. But if you want to do a 0:17:34.520 --> 0:17:37.600 lower case A, that would be a zero one one 0:17:37.960 --> 0:17:42.920 zero zero zero zero one. Minor distinction, but it makes 0:17:42.920 --> 0:17:45.919 a big difference in binary. And when you figure this 0:17:45.960 --> 0:17:48.080 out that every single one of those areas can be 0:17:48.240 --> 0:17:51.280 either a zero or a one, and it takes eight 0:17:51.359 --> 0:17:54.440 of them just to make one character, you realize, I'm 0:17:54.440 --> 0:17:57.200 gonna need a whole lot of those areas to store 0:17:57.240 --> 0:18:00.920 any meaningful amount of information. So it really is billions 0:18:01.119 --> 0:18:04.920 of them, and uh, that's why you gotta that's why 0:18:04.920 --> 0:18:07.200 you gotta pack all that into the hard drive, otherwise 0:18:07.240 --> 0:18:09.199 you wouldn't be able to save any meaningful amount of 0:18:09.200 --> 0:18:12.520 information to it. Now, the way a computer writes data 0:18:12.560 --> 0:18:15.720 to a hard drive involves using a very tiny magnet 0:18:15.920 --> 0:18:18.359 on the end of a mechanical arm, and it looks 0:18:18.400 --> 0:18:20.239 kind of like a record player, which I know you 0:18:20.280 --> 0:18:23.359 guys know about now. Like for the longest time, I 0:18:23.359 --> 0:18:26.360 always had to say, hey, ask your parents, But hey, 0:18:26.520 --> 0:18:29.439 vinyls coming back. People own record players again. There are 0:18:29.440 --> 0:18:32.080 bands putting out Vinyl albums. I'm so excited about this, 0:18:32.480 --> 0:18:34.840 largely because I no longer have to explain what it 0:18:35.000 --> 0:18:38.680 is anymore, because you guys already know. So it looks 0:18:38.760 --> 0:18:40.640 kind of like a record player. You've got a mechanical 0:18:40.760 --> 0:18:42.280 arm on the end of it. Instead of a needle, 0:18:42.480 --> 0:18:45.320 you have a magnet, and the mechanical arm can swing 0:18:45.520 --> 0:18:48.680 back and forth over a spinning platter. It can also 0:18:49.200 --> 0:18:52.800 hit all different spots of that. So you've got this 0:18:53.320 --> 0:18:56.760 basic mechanism here. It's pretty simple at least in theory, 0:18:57.400 --> 0:19:01.240 and that magnet can be used to magnetize demagnetize each 0:19:01.280 --> 0:19:04.679 of the areas on the hard disk. So with this 0:19:04.760 --> 0:19:07.240 type of hard drive, the computer tends to store data 0:19:07.240 --> 0:19:11.080 for files and physically adjacent or nearby areas. So in 0:19:11.119 --> 0:19:13.800 other words, the data that makes up the files on 0:19:13.840 --> 0:19:16.679 your physical hard drive tends to be located within the 0:19:16.720 --> 0:19:19.600 same general area of a platter, kind of like a 0:19:19.720 --> 0:19:23.840 track on a vinyl record album. So each song obviously 0:19:24.000 --> 0:19:27.520 is one section of a track that's in a concentric 0:19:27.560 --> 0:19:31.760 circle around this vinyl disc, right, Because if you just 0:19:31.920 --> 0:19:36.520 randomly assigned bits and pieces of songs throughout an album, 0:19:36.600 --> 0:19:39.720 it would be a mess. You wouldn't have anything really 0:19:40.080 --> 0:19:42.520 that you could easily listen to and make it meaningful. 0:19:42.840 --> 0:19:46.320 Same thing with hard drive platters. They tend to collect 0:19:46.359 --> 0:19:49.800 all the data for a file within adjacent spots on 0:19:49.840 --> 0:19:53.040 the platter, if possible. It also makes it easier and 0:19:53.119 --> 0:19:56.560 faster when a hard drive is reading data back that 0:19:56.640 --> 0:19:59.840 it can just focus on a specific section of the 0:20:00.000 --> 0:20:02.960 our drive platter and pull that information out. If it 0:20:03.000 --> 0:20:05.919 had to skip all over the platter, that would take 0:20:06.000 --> 0:20:07.840 up more time and create more wear and tear on 0:20:07.880 --> 0:20:11.000 the system. Those areas of data are called tracks, by 0:20:11.000 --> 0:20:14.520 the way, and they, like I said, are concentric circles 0:20:14.520 --> 0:20:17.720 their pathways that are on the platters themselves. Each track 0:20:18.000 --> 0:20:21.879 inside of it has smaller areas called sectors, and the 0:20:21.920 --> 0:20:25.239 computer keeps a record of all the sectors, and it 0:20:25.280 --> 0:20:27.840 knows which ones have files stored on them and which 0:20:27.880 --> 0:20:30.200 ones are free to write over. Now, the free ones 0:20:30.280 --> 0:20:32.760 may also have data on them, but it just means 0:20:32.840 --> 0:20:35.040 this is data that's not important, so you can write 0:20:35.040 --> 0:20:37.520 over it whenever you want. In a Windows machine, we 0:20:37.600 --> 0:20:41.280 call this record the file Allocation table or f a 0:20:41.359 --> 0:20:45.320 T or FAT. Now, notice all of that is for 0:20:45.359 --> 0:20:47.640 physical hard drives. If you have a machine that uses 0:20:47.680 --> 0:20:51.359 a solid state drive, it works a lot differently. Solid 0:20:51.400 --> 0:20:55.160 state drives will store data on lots of different available 0:20:55.200 --> 0:20:57.919 areas within the drive, so you don't necessarily end up 0:20:57.960 --> 0:21:01.160 with a sector or track of related data. The data 0:21:01.240 --> 0:21:03.160 is all on the drive, but it could be broken 0:21:03.200 --> 0:21:06.159 up into smaller pieces, kind of like Mike TV and 0:21:06.200 --> 0:21:08.800 Willy Wonka and the chocolate factory, you know, when he's 0:21:09.320 --> 0:21:13.160 being broadcast over the year. But they still store data 0:21:13.160 --> 0:21:14.959 in the forms of zeros and ones. All of that 0:21:15.040 --> 0:21:17.840 is still the same. It's still based on this binary code. 0:21:18.480 --> 0:21:21.720 And I'll get into how so these solid state drives 0:21:22.240 --> 0:21:24.760 organized data in just a minute, because it's important and 0:21:24.800 --> 0:21:27.679 it's a little weird. So if you wanted to wipe 0:21:27.760 --> 0:21:30.879 out a file on a physical hard drive, you'd want 0:21:30.920 --> 0:21:33.160 to use a program that would identify all the free 0:21:33.200 --> 0:21:35.320 areas on a hard disk platter. And then override that 0:21:35.320 --> 0:21:38.520 gibberish on top of those areas. And some of the programs, 0:21:38.560 --> 0:21:41.920 such as the ones used by military and intelligence agencies, 0:21:42.119 --> 0:21:44.600 will do this more than once to ensure that all 0:21:44.640 --> 0:21:48.280 records have been completely eradicated, So they'll override a hard 0:21:48.359 --> 0:21:54.000 drive two or three times, which is frankly overkill if 0:21:54.000 --> 0:21:56.840 you're doing it correctly, but it really does make sure 0:21:56.960 --> 0:22:00.919 that that data is irretrievable at least uh there's no 0:22:01.280 --> 0:22:04.160 there's nothing meaningful on there because it's been just completely 0:22:04.240 --> 0:22:07.560 replaced by gibberish multiple times. This process does take time, 0:22:08.240 --> 0:22:12.840 and since you are just writing meaningless information onto a 0:22:12.880 --> 0:22:16.160 physical hard drive, you know, think about saving a really 0:22:16.240 --> 0:22:18.399 big file to your hard drive and how long that 0:22:18.440 --> 0:22:22.800 can take. Well, if you're formatting an entired hard drive, 0:22:22.960 --> 0:22:25.280 this is gonna take as long as you know that 0:22:25.400 --> 0:22:28.439 hard drive can you know whatever that capacity is and 0:22:28.480 --> 0:22:31.960 whatever it's spinning rate is as well, so that ReadWrite 0:22:32.000 --> 0:22:34.679 rate is gonna matter a lot, and also just the 0:22:34.720 --> 0:22:36.760