Date: Thu, 14 Feb 2002 18:51:54 +0100 From: Erik Trulsson <ertr1013@student.uu.se> To: Lord Raiden <raiden23@netzero.net> Cc: freebsd-questions@freebsd.org Subject: Re: undeleting files Message-ID: <20020214175154.GA96242@student.uu.se> In-Reply-To: <4.2.0.58.20020214123535.009fec20@pop.netzero.net> References: <4.2.0.58.20020214123535.009fec20@pop.netzero.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Feb 14, 2002 at 12:36:34PM -0500, Lord Raiden wrote: > Ok, I know that it's supposed to be impossible to undelete files in > unix or freebsd, but my question is how this is possible? How does > unix/freebsd delete files in such a way that they are unrecoverable? Just > my curious side getting the better of me again. It is not impossible in general, merely difficult. There are basically two problems with undeleting files: The first is that the space that was used by a deleted file is quite likely to reused when some new file is created thereby making it impossible to recover the old file. The second problem is that there are not really any good tools for undeleting files, meaning that you have to use a disk editor to change the filesystem by hand. Not recommended for the faint of heart. To make it totally impossible to recover old files the system would have to zero-fill the blocks on the disk that was used by a file when the file is removed from the system. This is currently not done, presumably for performance reasons. (That still would not make it quite impossible to recover old data. It is possible to recover data from a disk even if it has been overwritten several times. Doing so is difficult and requires special, expensive equipment but it can be done.) -- <Insert your favourite quote here.> Erik Trulsson ertr1013@student.uu.se To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020214175154.GA96242>