LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 03-15-2013, 01:37 PM   #1
moraxu
LQ Newbie
 
Registered: Dec 2012
Distribution: Ubuntu
Posts: 15

Rep: Reputation: Disabled
Truncating an output file and overwriting its previous content


Hi.

I'm reading a book about Linux command line and came across the following section on dd utility:

Quote:
You can use a similar technique to wipe data from a file before deleting it, making it almost impossible to recover data from the deleted file.

In the following example, ls shows the size of the file named secret; dd, with a block size of 1 and a count corresponding to the number of bytes in secret, then wipes the file. The conv=notrunc argument ensures that dd writes over the data in the file and not another place on the disk.
So I have a simple question: if we don't use this argument or when we use output redirection on the command line to an existing file (bash truncates the file to zero bytes in that case), we can't say for sure that pointers to data blocks in the file's inode structure will still point to the same location as before the truncating?

Regards.
 
Old 03-15-2013, 02:44 PM   #2
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,604

Rep: Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241Reputation: 1241
Quote:
Originally Posted by moraxu View Post
Hi.

I'm reading a book about Linux command line and came across the following section on dd utility:

So I have a simple question: if we don't use this argument or when we use output redirection on the command line to an existing file (bash truncates the file to zero bytes in that case), we can't say for sure that pointers to data blocks in the file's inode structure will still point to the same location as before the truncating?

Regards.
Data blocks are just deallocated - not overwritten.

When an inode is deleted, there is a "deleted" flag set to indicate the file has been deleted, the data blocks ARE deallocated, but the inode will at a minimum retain a few pointers until it is reused. This does allow some "undelete" utilities to work, but reuse of the data pointers will leave the file corrupted... and the larger the time between deletion and "undeletion" the more likely the data will be corrupted. Large files are more subject to corruption as they have more metadata (multiple blocks of pointers to data) that can be reused - and prevent data blocks from being found, even if they haven't been reused yet.

There is also the issue of flash that might be used. In this case, you never really know because the device does write leveling to spread out the use of the storage. This "leveling" always writes to a unallocated block, even in the case of overwriting (it copies the block being written into memory, then does update, followed by a write to a new block).
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Sed – how do I save output to file with filename from content of another file? misarab Programming 4 02-28-2011 03:12 PM
Script to find tar archives, read tar file contents, output content to an index file. bluesword1969 Linux - General 4 02-07-2011 01:15 PM
[SOLVED] How to save the output to a log file without wiping the previous contents greatcz Linux - Newbie 2 07-25-2010 11:14 AM
Tar not overwriting previous backups neocookie Linux - General 6 02-13-2007 06:03 AM
truncating output of ls command chucker8 Linux - Newbie 2 03-02-2006 11:01 AM


All times are GMT -5. The time now is 10:47 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration