DELETED isn't gone.

emptying the recycle bin doesn't do what you think it does

you delete a file, you empty the recycle bin, you feel safe. cool story. the truth is your drive didn't shred anything. it just took the little label that said "this space is used" and changed it to "this space is free." the actual data is still sitting there in the same physical spot until something else happens to get written on top of it. that's the whole reason recovery tools like photorec exist, and it's also the whole reason "i deleted it" is not the same thing as "it's gone."

what photorec actually does

photorec doesn't care about your file system's index of what's deleted or not. it ignores that index entirely and reads the raw bytes on the disk looking for patterns that match known file signatures, the headers and footers that jpgs, pdfs, docs, zips, whatever, always start and end with. that's why it can pull files back even after the recycle bin is empty and even if the file table itself is corrupted or wiped. it's not undeleting a file in the normal sense, it's rebuilding files from raw data based on what they look like.

breaking down the command

photorec /log /dev/sdb1

photorec is the tool itself, part of the testdisk suite, free and open source.

/log tells it to keep a log file of everything it does during the recovery session, useful if you need to review what it found or troubleshoot later.

/dev/sdb1 is the target, in this case a specific partition on a secondary drive. this is the part people mess up the most. you never run this against the drive you're currently booted from and actively writing to, because every bit of activity on that drive risks overwriting the exact data you're trying to recover. you either boot from a live usb or point the tool at a drive that isn't your active system drive.

why this matters for your own privacy, not just recovery

flip this around for a second. if a stranger, an ex, a thief, or anyone else got physical access to your old drive, your "wiped" usb stick, or that laptop you sold on marketplace, a tool exactly like this could pull your tax documents, photos, or password exports right back out. deleting a file and even reformatting a drive through normal means does not destroy the underlying data. that's the privacy angle here. recovery tools aren't just for getting your stuff back, they're proof that "delete" is not "destroy," and that matters every time you sell, donate, recycle, or hand off a device.

how to actually make deleted data unrecoverable

if you want a file gone for real, you have to overwrite the space it lived in, not just remove the pointer to it. a few practical options:

on linux, shred overwrites a specific file multiple times before unlinking it:

shred -u -n 3 filename.txt

for full drives you're about to sell or toss, use something like nwipe or a full-disk overwrite with dd pulling from /dev/urandom, or better, use your drive's built in secure erase feature if it's an ssd. ssds and wear leveling make simple overwrite tricks less reliable, so encryption is actually your best long term move there.

speaking of which, full disk encryption with tools like luks on linux or bitlocker on windows means that even if someone recovers raw deleted data off your drive, it's unreadable garbage without the key. this is honestly the single best thing you can do, because it protects you against recovery tools running on lost, stolen, or improperly wiped drives.

the takeaway

run photorec on a spare drive of your own and see what actually comes back, it's a genuinely eye opening exercise in understanding how little "delete" really means. then go the other direction and think about every drive you've ever sold, tossed, or handed to a friend. if you didn't encrypt it or securely wipe it, there's a real chance old files are still sitting there waiting for someone with the right tool. encrypt your drives, securely wipe before you get rid of hardware, and stop trusting the recycle bin to protect anything you actually care about.