In part one of this article, we discussed how manual and automatic file deletion activities may leave data remnants on disk, which could compromise sensitive information. By understanding where these remnants hide, we are able to devise methods for preventing data leakage and permanently removing traces of old files. This is critical if an attacker could gain physical access to the system or if the storage medium is to be discarded, sold, or reused.

When files are deleted from Windows machines, whether via the Recycle Bin or by immediate deletion, they are not actually purged from the system. That is because Windows merely marks the area occupied by the files as available for reuse, and in so doing, removes them from view. However, the data remain on the drive, and the files may be recovered through trivial means.