I believe what the article referred to is unlinking of files. The way most operating systems delete files is by removing just the inode entry for that file, an

I believe what the article referred to is unlinking of files. The way most operating systems delete files is by removing just the inode entry for that file, and leave all data on the device to be overwritten at some later time. This way, forensics tools recover files that still reside in bits and pieces in blocks on file systems that aren't currently assigned to any file. Same technique applies to recovering these buffer images that the article talks about. Same story is with deallocating memory. A process will no longer claim a certain block of memory once it's not needed, but not actually overwrite the area with zeroes. Operating systems generally take the approach to not doing anything they don't have to for the sake of efficiency. There are tools however that will wipe the actual data multiple times before removing the inode (reference to that data) such that it makes it much more difficult to recover it. They do so multiple times due to magnetic traces on the actual drives that data leaves even when it's over written. RAM does not need to be overwritten multiple times, as far as I'm aware since it is a lot more transient. Also, if same files remained on your hard drive for a long time (years), overwriting it many times might simply not be enough as the data literally seeps deeper and deeper into the platter and might be recoverable with a precision shaving of platter material. I heard this evidence anecdotally, so take it at face value.