Chepngetich Mitei

When a large file, such as a 10GB file, is deleted, the operation appears instantaneous because the operating system does not immediately erase the actual data from the storage medium. Instead, it performs a logical deletion. File systems such as NTFS, ext4, or APFS manage files using metadata structures (e.g., Master File Table in NTFS or inodes in ext4). When a file is deleted, the OS simply removes the reference to that file from these metadata structures and marks the associated disk blocks as free for future allocation. This process is efficient because it avoids the costly operation of overwriting every byte of the file’s data. Physically erasing 10GB of data would require significant I/O operations, which is why file creation or copying takes longer: they involve actual data writes to disk. In contrast, deletion is primarily a metadata update, often involving only a few disk operations regardless of file size. The underlying data remains on the disk until it is overwritten by new data. This is why deleted files can often be recovered using forensic tools, provided the storage blocks have not been reused. From a digital forensics perspective, this behavior is critical, as it enables data recovery during investigations. However, for secure environments, specialized wiping techniques are required to ensure that the data is irrecoverable, as standard deletion does not remove the physical data.