Anyone with a cursory understanding of data recovery and sanitisation as it relates to hard drives is aware of the concept that data "permanently" deleted from within an operating system is not deleted, but simply marked as such in the MFT, and that the data exists on the drive until the sector that it occupies on the hard drive is overwritten with new data.
However, I recently realised that I'm hazy on whether this process is a function of the hard drive itself, or the filesystem on it (NTFS more than likely, since we're talking about the MFT). If it's the former, how different is this process in mechanical and solid state drives? If the latter, do other filesystems (apart from NTFS) handle the deletion of data radically differently?
No comments:
Post a Comment