I currently live with someone that I think may be recovering files I emptied from the Trash. It's their computer, they are admin, and I have a standard account. I just want to know are they capable of doing this? Is there anyway to find out obviously without having to just ask cause they'll lie anyways.


There are various ways how this can be done:

  • They may simply have a background job running which regularly copies all your files (whether in Trash or still in Documents etc) into a folder they control
  • They may use the backups created by Time Machine or any other backup software used
  • They can use data recovery software to recover deleted files

However, this doesn't necessarily mean that the other person is reading your files.

If you are concerned about the sensitivity of data/files, you are advised to take measures such as using an encrypted volume, not creating files locally, using an external drive to store and view files and additionally, using Private browsing mode in Web browsers etc.

  • I didn't feel like adding a new answer so I just extended yours :-) – nohillside Apr 30 at 10:14

When files are deleted from the trash, the information about the file is removed from the filesystem, but the areas on the disk that held the file ("sectors") are normally not zeroed out but awaits being reused later by other files as the operating system sees fit.

This mean that if none of the sectors that held the actual contents of your file have been overwritten yet, the file can be reconstructed. Programs exist that can scan all the sectors on a disk (requires superuser/admin rights) and look for hints about which sectors go together, and knowing stuff that sectors are typically allocated sequentially so sectors often belong together with the ones next to them, and can reconstruct files.

If you really do not want this to happen, I would suggest creating an encrypted disk image which you then mount when logging in, and keep all your sensitive stuff on. This will require your password to decrypt.

  • FileVault is whole-disk protection, not account protection (well FV2 at least, FV1 worked differently but isn't available any longer). Once any user has unlocked a FV2 drive all Administrators can access user data and copy it into their own folders for further analysis. – nohillside May 1 at 7:21
  • Removed the filevault comment, as apparently my knowledge was outdated. – Thorbjørn Ravn Andersen May 1 at 15:20

As implied in Nimesh Neema's answer: they wouldn't need to recover your deleted files -- because they already have access to ALL your files before they are deleted! It's their computer and they have admin privileges.

They wouldn't need to go to the effort of recovering your deleted files.

  • 1
    This would be better as a comment since it doesn’t answer the question. – dwightk May 1 at 15:57
  • @dwightk It addresses the question "are they capable of doing this" by reinforcing that they wouldn't need to go to that level of difficulty given the more far-reaching control they have over the user's files. But feel free to tidy it up any way you like. – benwiggy May 1 at 17:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .