A question about the command "rm"

DiZASTiX · 06-03-2003, 10:15 AM

Hey, when i do "rm --help" it says this at the end:

Quote:

Note that if you use rm to remove a file, it is usually possible to recover
the contents of that file. If you want more assurance that the contents are
truly unrecoverable, consider using shred.

Does this mean if i did "rm -r directory" i can get directory back with all the files that were in it? If so how? Thanks

mrtwice · 06-03-2003, 10:39 AM

When you use rm the reference to the file is removed but the actual bitmap of the file is still on the disk. technically, a person could come in and retrieve a file or files by searching your disk for bitmaps of common file configurations (which I don't know how to do) as long as they have not been written over by new information. Shred, I belive, will not only remove the reference but will also set the bitmap to all zeros erasing the old bitmap. If i am wrong about any of this, someone please correct me.

moses · 06-03-2003, 11:54 AM

rm just clears the inode. shred overwrites data before clearing the inode. However, shred is not necessarily effective on journaled filesystems. If you have removed an entire directory and have not yet written anything else to the disk, it is possible to recover your data, but it's not easy and many companies make their money doing just that. I'm sure you can find information on how to recover data by searching the web.