Overwrite / Overwritten Data
Deletion is reversible. Overwriting is not. When new data is written to the same physical storage space that previously held a deleted file, the original bytes are replaced and the file is gone for practical purposes. The boundary between “deleted but recoverable” and “overwritten and lost” is the single most important threshold in data recovery, and most consumers cross it without realizing what they’ve done.
BitRaser · DriveWipe
Clear, Purge, Destroy
Single-pass-sufficient era
Overwriting is the process of replacing existing data on a storage medium with new data, such that the original bytes no longer exist on the medium and cannot be recovered through normal data recovery means. Overwritten data is data that has been replaced in place by new data; from a recovery perspective, overwritten data is generally considered permanently lost. The fundamental rule of data recovery is that recovery exploits the gap between deletion and overwrite; once that gap closes via overwrite, the data is no longer recoverable through software-based or even most physical-recovery techniques.
What Overwrite Means in Data Recovery Context
The recovery industry uses “overwrite” with a specific technical meaning: new bytes have physically replaced old bytes at the storage location where the old data lived. This is different from deletion, which only changes the file system’s bookkeeping while leaving the actual data bytes untouched on the storage medium.1
The two ways overwriting happens
Overwriting on a storage device occurs through two mechanisms with very different implications:
- Incidental overwrite during normal use: when the operating system writes new files (downloads, app installs, OS updates), it allocates storage space from the pool of available blocks. If those allocated blocks happen to contain the bytes of a previously-deleted file, the previous content is overwritten as a side effect. Most overwrites that frustrate recovery happen this way.
- Intentional secure-erase overwrite: a user runs a tool specifically designed to overwrite data: shred, sdelete, BleachBit, DBAN, or similar. The tool’s purpose is to make recovery infeasible, and it writes specific patterns (zeros, random data, or known patterns) to the target storage locations.
File-level vs full-disk overwrite
Different overwrite scopes produce different outcomes:
- File-level overwrite targets a specific file’s storage space, leaving the rest of the disk untouched. Tools like sdelete -p target individual files. The risk is that the file may have left fragments in slack space, journal entries, or temp files that aren’t covered by file-level overwrite.
- Full-disk overwrite writes new data to every accessible storage location on the drive. DBAN and similar tools work this way. More thorough than file-level but takes longer (hours for a multi-TB drive) and destroys all data on the drive.
- Free-space overwrite overwrites only the storage space marked as available; existing files are preserved. Useful for cleaning up after deletion of sensitive files without destroying the entire drive contents.
What makes overwriting different from secure erase
Overwriting is a software-level operation that uses the storage device’s normal write commands. Secure Erase is a firmware-level operation built into the device itself. For HDDs, both achieve the same result; for SSDs, only secure erase works correctly. The distinction matters because users who run multi-pass overwrite software on SSDs may believe they’ve achieved sanitization when in fact the SSD’s wear leveling has left old data scattered across NAND cells the overwrite never reached.
Why Overwritten Data Is Generally Unrecoverable
The recoverability story has a clear boundary: deleted-but-not-overwritten data is recoverable through standard means; overwritten data generally is not. The technical reasons explain why this boundary is harder than it might sound to cross in either direction.2
How HDD overwriting works at the physical level
Hard drives store data as magnetic patterns on the platter surface. When the drive writes new data to a sector, the write head’s magnetic field aligns the magnetic domains in that sector to encode the new data. The previous magnetic state is replaced by the new state; there is no separate copy preserved anywhere. After the write completes, the sector contains only the new pattern.
The Gutmann method myth
The most enduring myth in data sanitization is that residual magnetic traces of overwritten data can be recovered through specialized techniques like magnetic force microscopy. This belief originates from a 1996 paper by Peter Gutmann that proposed a 35-pass overwrite method based on the magnetic encoding of MFM and RLL drives of that era. The paper was technically reasoned for those specific drives. Modern drives use perpendicular magnetic recording (PMR) and shingled magnetic recording (SMR) at densities thousands of times higher than 1996-era drives, where the spacing between magnetic domains is so small that residual traces of previous states are not measurable in practice.
The Gutmann method has never been demonstrated to successfully recover data from a modern HDD that received even a single overwrite pass. Government and industry standards have moved on; the 35-pass method is considered legacy.
What residual data myths actually look like in practice
The DriveSavers documentation cites Mike Cobb, the company’s Director of Engineering, on this point: “Just because a drive has been ‘erased’ doesn’t always mean the data is truly gone.” The recovery industry’s perspective acknowledges that erasure can be incomplete, but the cases where data remains recoverable after attempted erasure are not the magnetic-residual myth; they’re cases where overwriting missed parts of the drive. Common gaps include:
- Remapped sectors: sectors that the drive’s firmware has marked bad and replaced with spares; standard overwrite tools don’t reach the original physical sectors.
- Host Protected Area (HPA): a hidden region of the drive that the BIOS/firmware can hide from the operating system; standard overwrite operations may not touch it.
- Device Configuration Overlay (DCO): similar to HPA; another hidden region that overwrite tools may miss.
- Overprovisioned space on SSDs: NAND cells the SSD reserves for wear leveling and bad-block replacement; not addressable from the host.
- Manufacturing service area: drive firmware and calibration data; not typically accessible for overwrite.
None of these are recoverable through magnetic residue. They’re recoverable because the overwrite never touched them. The fix is using firmware-level sanitize commands that reach these areas.3
When partial overwrite leaves recoverable fragments
If only part of a deleted file’s storage space has been overwritten, the unwritten portions may still contain the original data. Recovery software can sometimes reconstruct partial files from these fragments. Common partial-overwrite scenarios:
- A deleted file’s clusters are gradually consumed by new files; some clusters get overwritten while others don’t.
- A new file is smaller than the deleted file it’s replacing; the tail end of the deleted file may persist in unallocated space.
- Fragmented files have some fragments overwritten and others preserved.
These partial recoveries produce incomplete files (corrupt JPEGs that show partial images, truncated documents) rather than fully usable recovered files.
The Multi-Pass Myth and What’s Actually Required
For decades, IT culture has believed that secure erasure requires multiple overwrite passes with specific patterns. This belief is no longer technically correct for modern storage.4
Where multi-pass requirements came from
Several historical standards specified multiple passes:
- DoD 5220.22-M (1995): required three passes for HDD sanitization; one with a fixed character, one with the complement, one with a random character, followed by verification. Widely adopted as a generic “secure erase” baseline.
- Gutmann method (1996): 35 passes with specific patterns designed to defeat residual magnetic traces on MFM and RLL drives.
- NSA/CSS Storage Device Sanitization Manual (1990s-2000s): multi-pass requirements for classified data sanitization.
- British HMG Infosec Standard No. 5: three-pass overwrite for sensitive data.
These standards were developed when drives used much lower data densities and different magnetic encoding. The technical concerns that motivated multi-pass requirements largely don’t apply to modern drives.
What current standards say
The most authoritative modern guidance comes from NIST SP 800-88 Rev. 2 (September 2025): “A single overwrite pass is sufficient for modern HDDs at the Clear level: multi-pass methods are legacy thinking.”5 The technical reasoning:
- Modern drives use PMR or SMR encoding at data densities where residual magnetic traces are too small to be detected reliably.
- Drive firmware translates writes through internal mapping and may handle multiple passes differently than expected.
- Single-pass-with-verification provides the same practical security as multi-pass and takes a fraction of the time.
- For Purge-level sanitization, firmware-level commands (Secure Erase, Sanitize) are preferred regardless.
When multi-pass is still relevant
Limited cases where multi-pass overwriting still has practical value:
- Compliance with legacy standards: some regulatory frameworks still reference DoD 5220.22-M; multi-pass may be required for documentation purposes even when not technically necessary.
- Very old drives (pre-2001 MFM/RLL): drives at densities where multi-pass concerns might still apply; rare in modern environments.
- Defense-in-depth policies: organizations choosing extra overwrite passes for risk-management reasons rather than technical necessity.
For practical purposes, single-pass overwriting with verification is the modern correct approach for HDDs. Multi-pass is overkill that takes longer without providing additional security.
The SSD Overwrite Problem
For solid-state drives, the entire concept of overwriting needs reframing. SSDs cannot be “overwritten” in the simple sense that HDDs can. The wear-leveling mechanism that extends SSD lifespan also makes overwrite-based sanitization unreliable.6
How wear leveling defeats overwriting
An SSD contains many NAND flash cells, each with a limited number of write cycles. To extend the drive’s life, the SSD’s controller distributes writes across all cells rather than repeatedly writing to the same cells. When you tell the SSD to write to logical block 100:
- The controller looks at its internal mapping table to find which physical NAND cell currently holds block 100’s data.
- The controller selects a different physical NAND cell that has had fewer writes (the wear-leveling decision).
- The controller writes the new data to the new physical cell.
- The controller updates its mapping table so future reads of block 100 will find the new physical cell.
- The original physical cell that held block 100’s old data is marked as containing stale data, but the data isn’t immediately erased; it sits there until the SSD’s garbage collection eventually clears it for reuse.
The result is that overwriting block 100 doesn’t actually overwrite block 100’s NAND cell. The old data persists in a different physical cell, no longer mapped to any logical address but still electrically present. Chip-off recovery can sometimes access this orphaned data because chip-off bypasses the controller and reads NAND directly.
The “full disk overwrite” deception
Running DBAN, sdelete, or similar overwrite tools on an SSD produces the appearance of a full overwrite but doesn’t deliver actual sanitization:
- The tool writes to every logical block address.
- The SSD’s controller distributes those writes across NAND cells via wear leveling.
- Many cells that contained old data may not be written to during the operation; they simply become unmapped.
- Overprovisioning space (NAND reserved for replacement and wear leveling) is not addressable from the host and is not touched by overwrite tools.
- The drive reports success, but old data persists in cells the overwrite never reached.
Correct SSD sanitization
Modern SSD sanitization uses firmware-level commands that the drive’s controller executes internally:
- ATA Secure Erase: the SATA-standard command for sanitizing SATA SSDs. The SSD’s controller clears all NAND cells, including overprovisioning space. Faster than overwriting (often minutes) and more thorough.
- NVMe Sanitize: the NVMe-standard equivalent. Three modes: Block Erase (clears all NAND), Crypto Erase (destroys encryption key), and Overwrite (writes pattern to all blocks).
- Cryptographic Erase on self-encrypting drives: destroys the encryption key; all data on the drive becomes encrypted ciphertext that cannot be decrypted. Effectively instantaneous.
- Vendor-specific tools: Samsung Magician, Crucial Storage Executive, Intel Memory and Storage Tool, and similar manufacturer utilities provide GUI access to firmware sanitize commands.
Practical SSD sanitization workflow
For consumers and IT departments wanting to sanitize SSDs:
- Don’t rely on overwriting with traditional tools.
- Use the manufacturer’s utility if one is available; it typically wraps the firmware sanitize command in a user-friendly interface.
- For NVMe drives, use
nvme sanitizefrom a Linux command line or equivalent. - For self-encrypting drives, cryptographic erase is the fastest and most reliable approach.
- Verify the sanitization using whatever logging the firmware provides; the host operating system may not be able to verify completion otherwise.
NIST SP 800-88: The Modern Authoritative Standard
The US National Institute of Standards and Technology publishes Special Publication 800-88, the most widely cited authoritative standard for media sanitization. The current version is Revision 2, published September 2025, which supersedes Revision 1 from 2014 and adds specific guidance for NVMe, flash storage, and self-encrypting drives.7
The three sanitization levels
| Level | What it does | Appropriate when |
|---|---|---|
| Clear | Logical techniques (overwriting or vendor resets) that defeat basic recovery tools | Routine internal device reuse; basic risk reduction |
| Purge | Advanced techniques (firmware sanitize, cryptographic erase, degaussing for HDDs) that resist sophisticated forensics | Devices leaving organizational control; higher-sensitivity data |
| Destroy | Physical destruction (shredding, melting, incineration) that renders the medium unusable | Highest sensitivity; end-of-life disposal |
Per-medium recommendations
NIST 800-88 provides specific recommendations by storage medium:
- HDDs (magnetic): Clear via single-pass overwrite with verification. Purge via firmware sanitize, degaussing, or cryptographic erase if drive is self-encrypting. Destroy via shredding to specific particle size.
- SSDs (SATA, NVMe): Clear via vendor sanitize/format that clears mapping tables. Purge via ATA Secure Erase, NVMe Sanitize, or cryptographic erase. Destroy via shredding or incineration.
- Self-encrypting drives: Cryptographic Erase meets or exceeds Clear; can satisfy Purge depending on encryption strength.
- Flash media (USB drives, SD cards): Sanitize via vendor command or cryptographic erase; physical destruction for highest sensitivity.
- Optical media (CDs, DVDs, Blu-ray): Destroy is the only reliable sanitization; logical erasure isn’t sufficient.
Why NIST 800-88 matters
The standard is referenced by major regulatory frameworks (HIPAA, GDPR, CMMC) and is the de facto baseline for enterprise data destruction policies. Compliance with NIST 800-88 provides documented support for the sanitization process, which matters in regulated industries and in cases where data destruction may be challenged. Consumer-tier sanitization decisions don’t require NIST compliance, but the standard’s technical recommendations (single-pass for HDDs, firmware commands for SSDs) are good guidance for any context.
What changed in Revision 2 (2025)
The September 2025 revision adds specific guidance for storage technologies that didn’t exist or were rare when Rev. 1 was published in 2014:
- NVMe-specific sanitization commands with detailed mode coverage.
- Self-encrypting drive guidance for cryptographic erase as a primary sanitization method.
- Updated SSD recommendations reflecting wear-leveling realities.
- Cloud and virtual storage guidance for sanitizing data in shared environments.
- Verification requirements emphasized more strongly.
The overwrite concept is the recovery industry’s hard threshold. Everything before overwrite is potentially recoverable; everything after overwrite is not. For consumers facing recovery decisions, this threshold drives the urgency message: stop using the drive immediately to prevent overwrites, attempt recovery quickly to maximize odds. For IT departments and organizations, overwrite is the threshold that determines whether retired storage media presents an information disclosure risk; data that has been properly overwritten poses no recovery risk, while data that has only been deleted does.8
The technical complexity has shifted significantly with the rise of SSDs and self-encrypting drives. The simple HDD overwrite model (write zeros to the sector, the data is gone) doesn’t apply to SSDs at all due to wear leveling. Organizations that haven’t updated their data destruction policies for SSDs may be inadvertently leaving recoverable data on retired drives. The correct approach for SSDs combines firmware-level sanitize commands with cryptographic erase, not multi-pass overwriting that the SSD controller silently subverts. Recovery software on properly sanitized media will return nothing useful; recovery software on improperly sanitized media may return substantial old data, depending on how the sanitization was attempted.
For users worried about whether their deleted files are truly gone, the practical answer depends on storage type and what’s happened since deletion. On HDDs with normal use after deletion, files are gradually overwritten by ordinary disk activity; total elapsed time is the rough proxy for whether deletion has effectively become overwrite. On SSDs with TRIM enabled, deletion plus TRIM can effectively complete the overwrite within minutes. On encrypted drives, the question is whether the encryption key is intact: if yes, the deletion bookkeeping is the only access barrier; if the key is lost, the encrypted data is mathematically inaccessible regardless of whether overwriting has happened. The “permanently lost” line is sometimes closer than users expect and sometimes farther; the storage medium and what’s happened since deletion are the determining factors.
Overwrite FAQ
Overwriting is the process of replacing existing data on a storage medium with new data, such that the original bytes no longer exist on the medium. When a file is deleted, its content remains on disk in the storage space the file occupied; that storage space is marked as available for reuse. When the operating system later writes new data to that same space, the new data physically replaces the original bytes. After overwriting, the original data is no longer present on the storage medium and recovery becomes infeasible through normal means. Overwriting can happen as a side effect of normal disk activity (saving new files, installing applications, system updates) or as an intentional secure-erase action where the user runs a tool specifically to overwrite deleted file space.
For modern storage devices, generally no. Once data has been overwritten with new data, the original is replaced byte-for-byte at the physical level on hard drives, and recovery from the new bytes alone is mathematically infeasible. There’s a long-standing myth that residual magnetic traces of overwritten data can be recovered with specialized equipment, originating from a 1996 paper by Peter Gutmann. This may have had some basis on the very low-density drives of that era but has never been demonstrated in practice on modern PMR or SMR hard drives. Government and industry standards like NIST SP 800-88 confirm that a single overwrite pass is sufficient to make data unrecoverable on modern HDDs. SSD overwrite is different and more complicated due to wear leveling, but even there the original data is generally not recoverable once a proper sanitization command has been used.
For modern HDDs (post-2001 PMR drives and current SMR drives), a single overwrite pass is sufficient. NIST SP 800-88 confirms that one pass with verification meets the Clear sanitization level, which is appropriate for most use cases. The 7-pass DoD 5220.22-M standard and the 35-pass Gutmann method are legacy recommendations from when drives used much lower data densities and different magnetic encoding. They were never demonstrated to be necessary in practice on modern drives. Multi-pass overwriting takes much longer than single-pass and provides no real additional security on current hardware. For SSDs, the question is moot because overwriting doesn’t work properly anyway; SSD sanitization requires firmware-level commands like ATA Secure Erase or NVMe Sanitize, not multi-pass overwrites.
SSDs use a feature called wear leveling that spreads writes across many physical NAND cells to extend the drive’s useful life. When you write to logical block 100, the SSD’s controller doesn’t necessarily write to the same physical NAND cell that previously held block 100’s data; it writes to a different physical cell that has had fewer writes, and updates its internal mapping table to reflect the new location. This means a ‘full disk overwrite’ on an SSD doesn’t actually overwrite every NAND cell; the controller may have left old data in cells that are no longer mapped to logical addresses but still contain the original bytes. Forensic recovery techniques can sometimes access this ‘orphaned’ data through chip-off recovery. The correct way to securely erase an SSD is with firmware-level commands like ATA Secure Erase or NVMe Sanitize, which instruct the SSD’s controller to actually clear all NAND cells.
Overwriting is a software-level operation: a tool reads each storage location and writes new data to replace the old. Software performs overwriting through the normal write commands the storage device exposes. Secure Erase is a firmware-level operation built into the storage device itself; the host computer issues a single command and the device’s internal firmware handles clearing all NAND cells or magnetic tracks. For HDDs, both approaches achieve the same result. For SSDs, only secure erase actually clears the entire NAND, because overwriting goes through the controller’s wear-leveling logic and may miss cells. The ATA Secure Erase command (for SATA drives) and the NVMe Sanitize command (for NVMe drives) are the standard secure-erase implementations. Self-encrypting drives also support cryptographic erase, which destroys the encryption key and instantly invalidates all data without writing to each cell.
NIST Special Publication 800-88 is the US National Institute of Standards and Technology’s guide for media sanitization. It’s the authoritative standard for how to make data unrecoverable on storage media. The current version is Revision 2, published September 2025, which supersedes Revision 1 from 2014 and adds specific guidance for NVMe drives, flash storage, and self-encrypting drives. The standard defines three sanitization levels: Clear (overwrite or basic logical techniques, sufficient for most internal reuse), Purge (advanced techniques like firmware sanitize commands or cryptographic erase, for media leaving the organization), and Destroy (physical destruction, for highest sensitivity). NIST 800-88 is referenced by HIPAA, GDPR compliance frameworks, and most enterprise IT policies, making it the most widely cited authoritative source for what ‘truly erased’ actually means.
Related glossary entries
- Deleted File: the upstream concept; overwrite is what makes deletion permanent.
- TRIM Command: the SSD feature that effectively performs overwrite via NAND zeroing.
- SSD: the storage type where overwriting doesn’t work as expected.
- Chip-Off Recovery: technique that can sometimes access orphaned NAND data after SSD overwrite attempts.
- Data Recovery: the broader discipline; overwriting is the hard threshold beyond which recovery fails.
- HDD: the storage type where simple overwrite still works correctly.
- Slack Space: where file-level overwrite often misses fragments of deleted data.
Sources
- DriveWipe: NIST 800-88 Explained: The Modern Standard for Data Erasure (accessed May 2026)
- DriveSavers: NIST 800-88 and Data Erasure Verification
- DriveSavers: same source, on residual data and inaccessible regions
- Workwize: NIST 800-88: Complete Guide to Media Sanitization
- DriveWipe: same source, on single-pass sufficiency
- DriveWipe: same source, on SSD wear leveling and overwrite limitations
- AccountableHQ: Hard Drive Sanitization: NIST 800-88 Guide
- BitRaser: NIST 800-88 Clear and Purge Techniques
About the Authors
Data Recovery Fix earns revenue through affiliate links on some product recommendations. This does not influence our reference content. Glossary entries are written and reviewed independently based on documented research, vendor documentation, independent testing, and recovery-engineer review. If anything on this page looks inaccurate, outdated, or worth revisiting, please reach out at contact@datarecoveryfix.com and we’ll review it promptly.
Slack Space
