• Hildegarde@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 month ago

    If you delete normally, only the index of the files are removed, so the data can be recovered by a recovery program reading the “empty” space on the disk and looking for readable data.

    If you do a single pass erase, the bits will overwritten one time. About half the bits will be unchanged, but that makes little difference. Any recovery software trying to read it will read the newly written bits instead of the old ones and will not be able to recover anything.

    However, forensic investigation can probably recover data after a single pass erase. The shred command defaults to 3 passes, but you can do many more if you need to be even more sure.

    Unless you have data that someone would spend large sums on forensics to recover, 1 to 3 passes is probably enough.