Erasing files from your hard drive (emptying the trash), just means that you’ve told the Mac operating system to earmark those files to be over-written but they are not actually removed from the system entirely. In short, these files have just been made ‘invisible’ to the user whilst it awaits to be over-written.
Such files can be retrieved using sophisticated ‘data recovery’ applications in the hands of a trained data forensics expert. Which may not be desirable when it comes to mission critical data that you don’t want to land in the wrong hands.
Secure Empty Trash
Mac OS X Tiger users, can secure their trash immediately during the Empty Trash process, by clicking on Secure empty Trash in their Finder menu which instructs Mac OS X to over-write files removed from Trash.
Erase Free Space
If you’ve emptied the Trash through conventional means and become suddenly worried that the data might be retrievable, you can launch Disk Utility to over-write the Trashed files. Disk Utility, can be found within the Applications/Utilities folder. Once you’ve launched Disk Utility select the Volume the trashed files are located on and click on the ‘Erase Free Space’.
This opens up an option window where you can select from 3 over-write modes that are available in Disk Utility 10.5.3 that ships with Mac OS X Tiger. Each mode over-writes the trashed files with zeros, effectively ‘washing’ the trashed files permanently from your hard drive. The level of security increases proportionately to the number of passes run over the trashed files. As does, the time taken to carry out the over-writing process.
Note that carrying out any of the above methods of data removal will severely compromise the ability to recover the trashed files from your hard drive. Only use these prescribed methods where you are absolutely certain that the trashed files should remain — trashed.
Recovering Accidentally Trashed Files
Expanding from the knowledge of how files are trashed, should a situation arise where important files have been accidentally erased from your hard drive, the appropriate action to take, would be to shutdown your computer immediately and not restart it. The computer should, from then on, be only handled by an experienced data forensics expert to retrieve the lost data. Continuing to use the computer after realising that important files have been accidentally erased will only decrease the chances of data retrieval.