Sunday, May 31, 2020

When you delete a photo from your phone where does it it to find out


At the moment the data is deleted, the actual data stream of the photo still remains in the sectors where it was inside the phone’s memory. The only real change that’s made immediately is that the filesystem, which is sort of like a directory the device uses to look up the location of files in the memory, is updated to show that the file no longer exists. Then the sectors are marked as unallocated, meaning they are now “available” to be written to with new data.

So instantly after a photo is deleted, it should be recoverable in theory. However, very soon one of two things will happen. If it’s a very new device it may support T.R.I.M. and the garbage collection cycle will soon run. When this happens the sectors where the picture was will be zero-filled. This is due to a limitation of NAND memory only being able to write individual ones, but not zeros. To write a zero an entire block must be erased and the data shuffled around and re-written. So T.R.I.M. takes advantage of idle times to prepare the sectors for new data by preemptively zeroing out and getting it ready for new data.

If it’s an older device that doesn’t support T.R.I.M. (most phones currently around) the data will stay there in the sectors, but since the area is marked as unallocated another file will eventually overwrite some or all of these sectors, making recovery impossible. Even just daily use like texting, browsing the web, etc. is constantly generating new files, so it may not be long before a deleted photo is overwritten.

Data that has been overwritten or been T.R.I.M.’ed out can never be recovered and simply ceases to exist.

Leave a Response