File deletion

I was just watching an uninstaller run today (uninstalling WindowBlinds, trial period was over and I didn't think much of it anyway) and got to thinking, how are files actually physically erased from disk?

I'm not talking about any particular OS here.

So would I be right in thinking the file is overwritten with 0's? Or is the process dependant on the file system being used? Or the OS?

Just curious.

Nah, mostly it's just by removing the directory entry from the file system.
Actually, it's more like just set a specific bit in the directory entry which means 'deleted'.

File recovery firms make use of this to recover the contents of files you've deleted by mistake.

The file system is just another database, and like other databases, when you "delete" something, all you're doing is detaching it from a data structure. It's still physically there until something writes over it (now that it's a "free" block).

P.S. Wouldn't it be cool to be able to run SQL queries on a file system? :cool:

Secure deletion programs overwrite the file with garbage before deleting it so data recovery programs can't recover the file.

So what is the difference between a quick format and a regular (slow) format? I would guess that a slow format would "zero" out the file system.

Yes, although a slow format is more about verifying sectors. Touch every part of the volume to be erased and if the hardware comes back with an error at any point you've saved some heartache. ;)