Logical deletion

Logical deletion is what an ordinary delete command usually does. The operating system removes the file’s entry from the file system’s index and marks the blocks it occupied as available, but it does not erase the blocks themselves. The data stays in unallocated space until new writes happen to land on it, and fragments can also survive in slack space. A quick format behaves in much the same way. Recovery and forensic tools can commonly rebuild files from these areas, which is why logical deletion is not a form of media sanitisation.

Logical deletion is where data remanence begins: it removes the reference, and remanence is what stays behind. Clearing, for example by overwriting, replaces the contents of user-addressable locations, and purging aims to defeat laboratory recovery. On solid-state drives the TRIM command can lead the controller to erase freed blocks later, but the timing is not guaranteed, and wear levelling can leave old copies in cells the operating system cannot reach.

Exam relevance: a scenario may describe files deleted or a drive reformatted before disposal, and ask whether the data is safe. Candidates are expected to recognise that deletion and formatting leave data recoverable, and to choose a sanitisation method matched to the media and the sensitivity of its data.