Trash: Where Does It Go?
- Thread starter Amie
- Start date
ElDiabloConCaca
U.S.D.A. Prime
"Put into unused disk space" may be a little misleading -- no data is physically moved on the drive to anywhere else -- it all stays in the same place... all that REALLY happens is that the directory entries on the drive for those files on the drive are marked as "invalid", meaning the data there is gobbledy-gook and can be overwritten with new data when needed, like bob said.
When you do a secure empty trash, the same thing happens (directory entries are marked "invalid"), but then the actual 1s and 0s that existed there are written over several times with different 1s and 0s.
It's possible to rebuild a directory entry simply by the data on the drive... this is why data recovery software like Data Rescue X works -- it actually scans the drive and sees exactly what's there instead of trusting the directory for the drive. Then it can rebuild a new, temporary directory, and the files can be retrieved.
When you do a secure empty trash, the same thing happens (directory entries are marked "invalid"), but then the actual 1s and 0s that existed there are written over several times with different 1s and 0s.
It's possible to rebuild a directory entry simply by the data on the drive... this is why data recovery software like Data Rescue X works -- it actually scans the drive and sees exactly what's there instead of trusting the directory for the drive. Then it can rebuild a new, temporary directory, and the files can be retrieved.
Satcomer
In Geostationary Orbit
The product for the truly paranoid is Permanent Eraser Up to Thirty Five times!
Mikuro
Crotchety UI Nitpicker
Every file system has a database of files. Without this database, it wouldn't know that all that data on the disk was actually a bunch of files; it would just be one giant mass of ones and zeroes. Things like the file's name, location, creation and modification dates, etc., are stored in this database. This is all called metadata it's data about other data (the file). A file's data and metadata are separate.
Like ElDiablo said, when you normally empty the trash, only the database (metadata) is affected. But when you use Secure Empty Trash, both the metadata AND actual data are erased. What's more, the data (and I think the metadata, too) is overwritten many times (I think 7; maybe 35) with random data, so that it cannot be recovered even with specialized data-recovery hardware.
Don't be too paranoid, though. I hardly ever use Secure Empty Trash. It's too slow to use for anything that you don't reaaaaally need destroyed. I find it useful on other computers (like at libraries or schools), but on my own Mac, there's rarely any reason to use it.
Like ElDiablo said, when you normally empty the trash, only the database (metadata) is affected. But when you use Secure Empty Trash, both the metadata AND actual data are erased. What's more, the data (and I think the metadata, too) is overwritten many times (I think 7; maybe 35) with random data, so that it cannot be recovered even with specialized data-recovery hardware.
Don't be too paranoid, though. I hardly ever use Secure Empty Trash. It's too slow to use for anything that you don't reaaaaally need destroyed. I find it useful on other computers (like at libraries or schools), but on my own Mac, there's rarely any reason to use it.
Now _please_ don't start to mix a volume format's database with the metadata coin... We use the "metadata" moniker for a _file's_ metadata, usually. This is only going to confuse things further, I believe. 
Apple should get around to clear things up a little, anyway. HFS+ is now available in no less than 6 variants, I believe. Do you want yours to honour case sensitivity or not, should it be journaled or not? Heck. Wasn't it simple when all we had to tell people was that "UFS bad, HFS+ good" for their basic consumer installs. And then there's metadata. Is it in a volume's database? Is it in the Spotlight database? Or do we still use resource forks? What, *ALL* of the above have metadata about our files? I wonder how it comes that our files don't choose to commit suicide from time to time.
Apple should get around to clear things up a little, anyway. HFS+ is now available in no less than 6 variants, I believe. Do you want yours to honour case sensitivity or not, should it be journaled or not? Heck. Wasn't it simple when all we had to tell people was that "UFS bad, HFS+ good" for their basic consumer installs. And then there's metadata. Is it in a volume's database? Is it in the Spotlight database? Or do we still use resource forks? What, *ALL* of the above have metadata about our files? I wonder how it comes that our files don't choose to commit suicide from time to time.
Mikuro
Crotchety UI Nitpicker
Meaning....what?fryke said:
Back in the old days, metadata meant the file system's metdata, and virtually nothing else. These days, there are many kinds of metadata (some improperly labeled as such), but that certainly doesn't mean the file system's metadata is no longer metadata!
In any case, I apologize if I confused matters.
You raise an interesting point: Spotlight. I'm not entirely sure how emptying the trash (securely or not) affects the Spotlight database. Does anybody know for sure? I never gave it much thought before.
ElDiabloConCaca
U.S.D.A. Prime
The Spotlight database is constantly being updated, as is evident by the process "mdimport" running all the time and sucking up 0.1% (very little) of the CPU cycles. When trash is emptied, the mdimport process will "realize" this and adjust the Spotlight index for that drive accordingly.
Amie
Mac Convert for Life
Verrrrrrry interesting. See, this is the kind of stuff that makes you go "Hmmm..."
By the way, why is it that every time I post something, at least one person posts a link with a product/app/program that they dub "only for the most paranoid users"? Are you trying to tell me something? lol
By the way, why is it that every time I post something, at least one person posts a link with a product/app/program that they dub "only for the most paranoid users"? Are you trying to tell me something?
lol
Amie
Mac Convert for Life
Actually, I wasn't worried. This time. This post was purely out of curiosity. I always wondered what happened to things when one empties their Trash. It just seems to ... disappear. I knew it had to be going *somewhere*. Stuff like that really gets the best of my curiosity. Probably 'cause I'm a science nerd at heart. 