Deleting files - Ubuntu

This is a discussion on Deleting files - Ubuntu ; When a Windows file is really deleted (not just moved to the Recycle bin) it remains on the HD and can be retrieved without too much effort if it hasn't been overwritten. Is the same true for Linux and ext3 ...

+ Reply to Thread
Results 1 to 5 of 5

Thread: Deleting files

  1. Deleting files


    When a Windows file is really deleted (not just moved to the Recycle bin) it
    remains on the HD and can be retrieved without too much effort if it hasn't
    been overwritten.

    Is the same true for Linux and ext3 partitions? Or is the mechanism different?

    --
    Hobart

  2. Re: Deleting files

    On Sat, 27 Sep 2008 01:11:41 -0400, Hobart wrote:

    > When a Windows file is really deleted (not just moved to the Recycle
    > bin) it remains on the HD and can be retrieved without too much effort
    > if it hasn't been overwritten.
    >
    > Is the same true for Linux and ext3 partitions? Or is the mechanism
    > different?


    What we're talking about here is at the hardware level, and deleted files
    on any filesystem can be recovered from the physical data still on the
    drive (obviously it will be much more difficult if the file is
    fragmented). The only way to make sure a file is truly gone is to write
    data--at least 3 times because there are residual magnetic markers or
    "ghost" of a file after the 1st and maybe even 2nd overwrite--to the
    physical location(s) the file resides at. There is lots of software that
    will perform this "wiping" process per file (or drive if you're going to
    give/sell the machine). Google is your friend their.

  3. Re: Deleting files

    On Sat, 27 Sep 2008 01:11:41 -0400, Hobart wrote:

    > When a Windows file is really deleted (not just moved to the Recycle
    > bin) it remains on the HD and can be retrieved without too much effort
    > if it hasn't been overwritten.
    >
    > Is the same true for Linux and ext3 partitions? Or is the mechanism
    > different?


    With any filesystem, deleted files have their allocation blocks marked as
    "available" in the allocation table, but the data in them remains. An
    exception would be a "high security" filesystem that intentionally
    "wipes" deleted sectors to prevent (presumably malicious) undeletion.
    Even if you have not saved anything to the disk since deleting a file, it
    is possible that some background process may use one or more of those
    allocation blocks, in which case the data is over-written, and would not
    be recoverable without very sophisticated computer forensic tools.

    Files deleted from an ext3fs can be undeleted if the involved sectors
    (called i-nodes in ext3 lingo) have not been re-allocated.



    --
    MarkA
    (This space temporarily unavailable)

  4. Re: Deleting files

    On Sat, 27 Sep 2008 01:11:41 -0400, Hobart wrote:

    >When a Windows file is really deleted (not just moved to the Recycle bin) it
    >remains on the HD and can be retrieved without too much effort if it hasn't
    >been overwritten.


    Only with a file system as primitive as FAT was it relatively easy to
    recover deleted files. NTFS isn't so easy.

    >Is the same true for Linux and ext3 partitions? Or is the mechanism different?


    No easier or harder than NTFS. I suggest you do backups of data you
    actually care about. Never leave data without a backup that you're
    not prepared to lose forever.

    Backing up your home directory against accidental deletes can be as
    simple as:
    sudo cp -a /home/ /home/.backup

  5. Re: Deleting files

    Hobart schreef:
    >
    > When a Windows file is really deleted (not just moved to the Recycle
    > bin) it remains on the HD and can be retrieved without too much effort
    > if it hasn't been overwritten.
    >
    > Is the same true for Linux and ext3 partitions? Or is the mechanism
    > different?
    >
    > --
    > Hobart


    You might try PhotoRec
    http://www.cgsecurity.org/wiki/Main_Page

+ Reply to Thread