Most standard applications and operating systems do not delete data in a secure way that is completely irreversible. Only the references to the file are removed from the administration information of the file system and the blocks that belong to the file are marked as free. However, the actual content of the blocks on the storage medium is retained and can be reconstructed with appropriate tools. This can enable attackers to access the files, such as when storage media are handed over to third parties or disposed of inappropriately. Confidential information may thus fall into the hands of unauthorised parties.

Swap files, swap partitions, and files for hibernation mode sometimes also contain confidential data such as passwords or cryptographic keys. However, this data and its contents are often not protected. They can be read, for example, if storage media are removed and reinstalled in another IT system.

The live operation of many applications also produces files not required for production environments, such as browser histories. These files can include security-relevant information, as well. If swap files or temporary files are not securely deleted, sensitive information, passwords, and keys can be misused by unauthorised parties to gain access to further IT systems and data, obtain a competitive edge on the market, or spy on the behaviour of users in a targeted manner.