On Sat, 27 Sep 2008 01:11:41 -0400, Hobart wrote:

> When a Windows file is really deleted (not just moved to the Recycle
> bin) it remains on the HD and can be retrieved without too much effort
> if it hasn't been overwritten.
>
> Is the same true for Linux and ext3 partitions? Or is the mechanism
> different?

What we're talking about here is at the hardware level, and deleted files
on any filesystem can be recovered from the physical data still on the
drive (obviously it will be much more difficult if the file is
fragmented). The only way to make sure a file is truly gone is to write
data--at least 3 times because there are residual magnetic markers or
"ghost" of a file after the 1st and maybe even 2nd overwrite--to the
physical location(s) the file resides at. There is lots of software that
will perform this "wiping" process per file (or drive if you're going to
give/sell the machine). Google is your friend their.

On Sat, 27 Sep 2008 01:11:41 -0400, Hobart wrote:

> When a Windows file is really deleted (not just moved to the Recycle
> bin) it remains on the HD and can be retrieved without too much effort
> if it hasn't been overwritten.
>
> Is the same true for Linux and ext3 partitions? Or is the mechanism
> different?

With any filesystem, deleted files have their allocation blocks marked as
"available" in the allocation table, but the data in them remains. An
exception would be a "high security" filesystem that intentionally
"wipes" deleted sectors to prevent (presumably malicious) undeletion.
Even if you have not saved anything to the disk since deleting a file, it
is possible that some background process may use one or more of those
allocation blocks, in which case the data is over-written, and would not
be recoverable without very sophisticated computer forensic tools.

Files deleted from an ext3fs can be undeleted if the involved sectors
(called i-nodes in ext3 lingo) have not been re-allocated.



--
MarkA
(This space temporarily unavailable)

On Sat, 27 Sep 2008 01:11:41 -0400, Hobart wrote:

>When a Windows file is really deleted (not just moved to the Recycle bin) it
>remains on the HD and can be retrieved without too much effort if it hasn't
>been overwritten.

Only with a file system as primitive as FAT was it relatively easy to
recover deleted files. NTFS isn't so easy.

>Is the same true for Linux and ext3 partitions? Or is the mechanism different?

No easier or harder than NTFS. I suggest you do backups of data you
actually care about. Never leave data without a backup that you're
not prepared to lose forever.

Backing up your home directory against accidental deletes can be as
simple as:
sudo cp -a /home/ /home/.backup

Hobart schreef:
>
> When a Windows file is really deleted (not just moved to the Recycle
> bin) it remains on the HD and can be retrieved without too much effort
> if it hasn't been overwritten.
>
> Is the same true for Linux and ext3 partitions? Or is the mechanism
> different?
>
> --
> Hobart

You might try PhotoRec
http://www.cgsecurity.org/wiki/Main_Page