Deleting a file removes only the signpost pointing to it — the bytes themselves sit on the disk for weeks or months, which is why forensic tools can still rebuild holiday photos from a drive you thought you wiped

What the operating system did instead was much smaller: it edited a table. When a file is deleted, the operating system does the cheap work. Why SSDs behave differently — and sometimes worseThe picture above assumes a spinning hard drive, where the operating system controls exactly which physical sector a block lives in. The logical block address the operating system sees no longer corresponds directly to a fixed physical location. On a drive that was encrypted from the start with BitLocker, FileVault, or LUKS, the bytes on disk are ciphertext.