LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 03-10-2010, 02:58 PM   #16
itsbrad212
Member
 
Registered: Nov 2009
Location: Chicago
Distribution: Arch and OpenBSD
Posts: 104

Rep: Reputation: 19

Quote:
Originally Posted by penguiniator View Post
rm deletes a file permanently. It is sent into oblivion.
Or move them to /dev/null

And sorry about my double post earlier in this thread. I accidentally hit the post button twice :P
 
Old 03-10-2010, 02:59 PM   #17
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
Blimey, don't move them to /dev/null. You write to it, a mv will replace /dev/null
 
Old 03-10-2010, 04:07 PM   #18
penguiniator
Member
 
Registered: Feb 2004
Location: Olympia, WA
Distribution: SolydK
Posts: 442
Blog Entries: 3

Rep: Reputation: 60
Quote:
Originally Posted by jamescondron View Post
Not quite. Scrub perhaps, but not rm.
Well, yes. My point was that rm should be used with extreme caution. There is no simple undelete command to restore rm'd files.
 
Old 03-10-2010, 04:13 PM   #19
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
Code:
root@jcmain:~# apt-cache search undelete
e2undel - Undelete utility for the ext2 file system
ntfsprogs - tools for doing neat things in NTFS partitions from Linux
magicrescue - recovers files by looking for magic bytes
recover - Undelete files on ext2 partitions
 
Old 03-10-2010, 04:18 PM   #20
penguiniator
Member
 
Registered: Feb 2004
Location: Olympia, WA
Distribution: SolydK
Posts: 442
Blog Entries: 3

Rep: Reputation: 60
Are we all using ext2 these days? I'm certainly not.
 
Old 03-10-2010, 04:20 PM   #21
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
Wow, I don't know how to answer that...

Ext3 and Ext4 are just the journalling versions of ext2; they're both ext2.
 
Old 03-10-2010, 04:23 PM   #22
penguiniator
Member
 
Registered: Feb 2004
Location: Olympia, WA
Distribution: SolydK
Posts: 442
Blog Entries: 3

Rep: Reputation: 60
And reiserfs, etc.? You cannot count on having an easy time of undeleting files on any filesystem. That's my point.
 
Old 03-10-2010, 04:27 PM   #23
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
Well, you can always go into Data Carving, which is a bit of a tarpit, though useful. There are many forensics tools out there that does this. That being said, I think a reiser partition is an extremely rare thing to find nowadays; lets face it, it was never that good.

And its hardly going to be improved, what with the designer's *ahem* legal problems.
 
Old 03-10-2010, 04:37 PM   #24
penguiniator
Member
 
Registered: Feb 2004
Location: Olympia, WA
Distribution: SolydK
Posts: 442
Blog Entries: 3

Rep: Reputation: 60
Also, its unlikely the op is using ext2. He's using Mac OS X.
 
Old 03-10-2010, 04:39 PM   #25
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
Well quite, but wasn't the matter being discussed whether or not rm sends a file into oblivion or not?
 
Old 03-10-2010, 04:44 PM   #26
penguiniator
Member
 
Registered: Feb 2004
Location: Olympia, WA
Distribution: SolydK
Posts: 442
Blog Entries: 3

Rep: Reputation: 60
In the context of Mac OS X's file system. Yes. And of course, even there files can be undeleted. But without advanced preparation, it is still not guaranteed to be a simple operation.
 
Old 03-10-2010, 04:50 PM   #27
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
Well in which case the shorter version of all of this is that it in fact sends it nowhere, and certainly not oblivion. Data carving, high end magnetic force microscopes, image analysis or a lot of high end equipment will bring, if not all, a fair chunk of the data back.

And as drives get larger and filesizes stay the same, similar or, thanks to better compression, smaller it'll get less and less likely that you'll sufficiently overwrite your files.

Which is great news for Forensics people, and also a good money spinner.
 
Old 03-10-2010, 04:52 PM   #28
penguiniator
Member
 
Registered: Feb 2004
Location: Olympia, WA
Distribution: SolydK
Posts: 442
Blog Entries: 3

Rep: Reputation: 60
Yeah, that's simple and easy.
 
Old 03-10-2010, 04:55 PM   #29
fbsduser
Member
 
Registered: Oct 2009
Distribution: Hackintosh, SlackWare
Posts: 266

Rep: Reputation: 30
Quote:
Originally Posted by jamescondron View Post
Well, you can always go into Data Carving, which is a bit of a tarpit, though useful. There are many forensics tools out there that does this. That being said, I think a reiser partition is an extremely rare thing to find nowadays; lets face it, it was never that good.

And its hardly going to be improved, what with the designer's *ahem* legal problems.
Maybe reiserfs is currently abandoned (it could get picked by someone else, it's opensource after all) but there are two other filesystems for linux that are in active development and aren't in the ext* family. Those are xfs and jfs, can you point to undeletion tools for them?
 
Old 03-10-2010, 05:05 PM   #30
jamescondron
Member
 
Registered: Jul 2007
Location: Scunthorpe, UK
Distribution: Ubuntu 8.10; Gentoo; Debian Lenny
Posts: 961

Rep: Reputation: 69
reiserfs probably wont be picked up, it took a lot of flack when it was in active development, xfs and jfs I don't know about; I'm pretty sure there is no undelete to recover paths/inode data but once again forensic techniques abound. Foremost has excellent results on xfs; jfs I've never looked at, though it seems stupid to assume that foremost wont have similar results.

@penguiniator:
There is an old phrase I remember reading in a Dawkins book, I can't remember who he attributes it too, and I dare say it doesn't matter; "Just because you don't understand doesn't mean I can't". I'm not saying these things are easy, though they're not as hard as I think you think they are (count the recursion..), and this was never a case of ease or difficulty.

You said the files get sent to oblivion. They don't. They get set as free/blank space, and as such can be recovered. Nothing more or less. I'm sorry if you've taken this as a personal insult or challenge, it certainly wasn't supposed to be, merely clearing up a misconception that, even if you yourself don't have, comments such as that lead other people to.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VLC + sudo = "cannot find any file in directory" error skubik Linux - General 3 11-30-2009 01:52 PM
Error: "libdmx.so.1: cannot open shared object file: No such file or directory" ESC201 Linux - Software 4 11-01-2008 08:38 PM
Format command shows "Cannot get current directory - I/O error" devn Solaris / OpenSolaris 1 06-18-2008 01:26 AM
Error in man command "sh: line 1: /usr/bin/gtbl: No such file or directory" MinA Slackware 1 09-06-2004 06:36 PM
error while trying to install program: "X11/Xlib.h: No such file or directory" nate1 Linux - Newbie 3 05-21-2004 08:08 AM


All times are GMT -5. The time now is 02:13 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration