From owner-freebsd-questions Thu Feb 14 9:52:42 2002 Delivered-To: freebsd-questions@freebsd.org Received: from maile.telia.com (maile.telia.com [194.22.190.16]) by hub.freebsd.org (Postfix) with ESMTP id A233E37B42A for ; Thu, 14 Feb 2002 09:51:57 -0800 (PST) Received: from d1o913.telia.com (d1o913.telia.com [195.252.44.241]) by maile.telia.com (8.11.6/8.11.6) with ESMTP id g1EHpto17051 for ; Thu, 14 Feb 2002 18:51:55 +0100 (CET) Received: from falcon.midgard.homeip.net (h185n2fls20o913.telia.com [212.181.163.185]) by d1o913.telia.com (8.8.8/8.8.8) with SMTP id SAA08171 for ; Thu, 14 Feb 2002 18:51:55 +0100 (CET) Received: (qmail 96260 invoked by uid 1001); 14 Feb 2002 17:51:54 -0000 Date: Thu, 14 Feb 2002 18:51:54 +0100 From: Erik Trulsson To: Lord Raiden Cc: freebsd-questions@freebsd.org Subject: Re: undeleting files Message-ID: <20020214175154.GA96242@student.uu.se> Mail-Followup-To: Lord Raiden , freebsd-questions@freebsd.org References: <4.2.0.58.20020214123535.009fec20@pop.netzero.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4.2.0.58.20020214123535.009fec20@pop.netzero.net> User-Agent: Mutt/1.3.27i Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Thu, Feb 14, 2002 at 12:36:34PM -0500, Lord Raiden wrote: > Ok, I know that it's supposed to be impossible to undelete files in > unix or freebsd, but my question is how this is possible? How does > unix/freebsd delete files in such a way that they are unrecoverable? Just > my curious side getting the better of me again. It is not impossible in general, merely difficult. There are basically two problems with undeleting files: The first is that the space that was used by a deleted file is quite likely to reused when some new file is created thereby making it impossible to recover the old file. The second problem is that there are not really any good tools for undeleting files, meaning that you have to use a disk editor to change the filesystem by hand. Not recommended for the faint of heart. To make it totally impossible to recover old files the system would have to zero-fill the blocks on the disk that was used by a file when the file is removed from the system. This is currently not done, presumably for performance reasons. (That still would not make it quite impossible to recover old data. It is possible to recover data from a disk even if it has been overwritten several times. Doing so is difficult and requires special, expensive equipment but it can be done.) -- Erik Trulsson ertr1013@student.uu.se To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message