From owner-freebsd-questions Thu Feb 14 12:16:20 2002 Delivered-To: freebsd-questions@freebsd.org Received: from smnolde.com (att-98-60-141.atl.mediaone.net [24.98.60.141]) by hub.freebsd.org (Postfix) with ESMTP id D4FDD37B417 for ; Thu, 14 Feb 2002 12:16:12 -0800 (PST) Received: from bsd ([192.168.10.7]) by smnolde.com with esmtp (Exim 3.30 #1) id 16bSIf-0001R3-00; Thu, 14 Feb 2002 15:16:13 -0500 Date: Thu, 14 Feb 2002 15:16:12 -0500 (EST) From: Scott Nolde To: Lord Raiden Cc: Subject: Re: undeleting files In-Reply-To: <4.2.0.58.20020214123535.009fec20@pop.netzero.net> Message-ID: <20020214151019.U46360-100000@bsd.smnolde.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Thus sayeth the previous author: >Date: Thu, 14 Feb 2002 12:36:34 -0500 >From: Lord Raiden >To: freebsd-questions@freebsd.org >Subject: undeleting files > > Ok, I know that it's supposed to be impossible to undelete files in unix >or freebsd, but my question is how this is possible? How does unix/freebsd >delete files in such a way that they are unrecoverable? Just my curious >side getting the better of me again. I've use the -P option with rm(1) to make it difficult to recover a deleted file: -P Overwrite regular files before deleting them. Files are overwritten three times, first with the byte pattern 0xff, then 0x00, and then 0xff again, before they are deleted. Addittionally, the -W option will try to undelete the named file provided it wasn't overwritten with other data. GNU tools have shred which will overwrite the file many more times with random data then truncate the file, and then finally unlink it. Scott Nolde GPG Key 0xD869AB48 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message