Why Deleting Files Isn\'t Enough: The Hidden Data Risk in Your Old Hard Drives
Every year, organisations across Malaysia dispose of computers, servers, laptops, and storage devices — many believing that deleting files, formatting drives, or resetting devices has made their data unrecoverable. In every one of those cases, the data is still there. Here is why, and what it means for your organisation's PDPA obligations.
How file deletion actually works
When you delete a file — whether you move it to the Recycle Bin and empty it, use Shift+Delete, or run a "delete all" command — the operating system does not erase the file's contents from the storage medium. What it erases is the file's entry in the directory: the record of where on the drive the file is stored. The underlying data — every character, every image, every spreadsheet row — remains physically written to the drive's storage medium until that specific area is overwritten by new data.
This is not a flaw or a security vulnerability. It is how storage systems are designed to work, because overwriting data on every deletion would significantly shorten drive lifespan and slow down operation. The consequence for data security, however, is significant: deleted files are recoverable by anyone with access to the drive and a recovery tool.
Formatting is not the answer either
A common misconception is that formatting a drive — particularly a "full format" as opposed to a "quick format" — makes data unrecoverable. On traditional magnetic hard drives (HDDs), a full format does overwrite data in some implementations, but recovery tools designed for forensic analysis can still retrieve significant portions of previously stored data from formatted drives, depending on the operating system and format type used.
On solid-state drives (SSDs), the situation is more complex and, from a security standpoint, more concerning. SSDs use a process called wear-levelling to extend drive lifespan by distributing writes across the storage cells. This means that when data is written to an SSD, the drive controller does not necessarily write to the same physical location each time — and when data is "overwritten," the original copy may remain on the drive in a different cell. Standard software wipe tools cannot reliably reach all of these locations. The only method guaranteed to destroy data on an SSD is physical destruction of the storage chips.
Who can recover deleted data
Data recovery is not the exclusive domain of government forensic laboratories or specialist agencies. Commercial data recovery software is freely available online — some of the most effective tools are open-source and cost nothing to download. A person with basic technical knowledge and a consumer-grade data recovery application can recover deleted files from an unformatted drive in a matter of minutes.
This means that a hard drive that leaves your organisation — whether sold secondhand, donated to charity, sent to a recycling facility, or simply placed in general waste — carries its full data history with it, accessible to anyone who retrieves it and knows how to look.
What data is typically at risk on old drives
Old drives from office computers, servers, laptops, and network-attached storage devices accumulate years of operational data. A drive from a decommissioned office PC might contain:
- Client databases and contact information
- Employee personal data, payroll records, and HR files
- Financial records, bank account details, and invoices
- Confidential business correspondence and internal communications
- Login credentials, netw
Ready to protect your organisation?Get a Free Quote →
Get a free consultation from Grass Stories Sdn Bhd — Sarawak’s trusted document destruction specialist.