LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 11-28-2015, 12:25 AM   #1
newbiesforever
Senior Member
 
Registered: Apr 2006
Location: Iowa
Distribution: Debian distro family
Posts: 2,373

Rep: Reputation: Disabled
why is my Linux partition full of deleted files?


An important file somehow became completely corrupted; and I had backed it up without knowing it was corrupted, so the backup was useless. I ran photorec, looking for a deleted version to restore from. I found most or all of what I needed, but to my surprise, I also found close to ten thousand deleted files of various types. Why do I have a very large number of deleted files? I thought Linux filesystems didn't leave very many deleted files, if any, and didn't need defragging.
 
Old 11-28-2015, 02:32 AM   #2
berndbausch
LQ Addict
 
Registered: Nov 2013
Location: Tokyo
Distribution: Mostly Ubuntu and Centos
Posts: 6,316

Rep: Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002Reputation: 2002
When a file is deleted, its data blocks and its metadata, often contained in a datastructure named "inode" (the name depends on the filesystem) are simply marked as unused. If they are not reused, they stay like this, and forensic tools like photorec find them.
 
Old 11-28-2015, 04:07 AM   #3
273
LQ Addict
 
Registered: Dec 2011
Location: UK
Distribution: Debian Sid AMD64, Raspbian Wheezy, various VMs
Posts: 7,680

Rep: Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373
How long have you had the drive and what, if anything, have you used it for prior to installing Linux. In theory, if you've had the drive 10 years and installed multiple OSs on it you may have "deleted" files still on it going back 10 years to the first OS install, for example.
 
Old 11-28-2015, 09:19 AM   #4
newbiesforever
Senior Member
 
Registered: Apr 2006
Location: Iowa
Distribution: Debian distro family
Posts: 2,373

Original Poster
Rep: Reputation: Disabled
This hard drive contains only Linux; I haven't used Windows in years. It might be a few years old.
 
Old 11-28-2015, 09:29 AM   #5
273
LQ Addict
 
Registered: Dec 2011
Location: UK
Distribution: Debian Sid AMD64, Raspbian Wheezy, various VMs
Posts: 7,680

Rep: Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373
What I was trying to say is that the files you found could have been created at any point during the life of the drive, since files are not actually deleted unless you use a "shredder". So unless you have wiped every sector of your drive there is no telling where the file headers found came from.
 
Old 11-28-2015, 11:08 AM   #6
DavidMcCann
LQ Veteran
 
Registered: Jul 2006
Location: London
Distribution: PCLinuxOS, Debian
Posts: 6,138

Rep: Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314Reputation: 2314
Fragmentation is when you have bits of current files scattered all over the place, with a lot of little gaps that are too small to use. The "files" detected by photorec are areas on the HD that contain bytes that were obviously once part of a file. From the point of the filing system, those bytes might as well be nulls: it knows nothing about them and will overwrite them automatically whenever it needs to. The problem with photorec is that it can't look for details of deleted files in the directories, as Linux completely removes them: it has to just hunt right through the HD, looking for any blocks of code on the off-chance that they might be files.

The moral is to always make alternate backups on different media: if my blue medium has a corrupted file, the pink one may well be OK.
 
Old 11-30-2015, 02:34 PM   #7
suicidaleggroll
LQ Guru
 
Registered: Nov 2010
Location: Colorado
Distribution: OpenSUSE, CentOS
Posts: 5,573

Rep: Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142Reputation: 2142
Quote:
Originally Posted by newbiesforever View Post
Why do I have a very large number of deleted files?
Because you and your OS have apparently deleted/modified a large number of files, which is perfectly normal. Think of how many intermediate files get created/deleted from a simple system update, and multiply that by several years.

Quote:
Originally Posted by newbiesforever View Post
I thought Linux filesystems didn't leave very many deleted files, if any
Linux, like OSX and Windows, does not clean up deleted files automatically. When a file is deleted, it's not actually wiped from the drive, the reference to it is simply removed and those blocks are free to be overwritten whenever the space is needed. If the blocks are never overwritten, then the file never actually disappears from the drive platters, and you can recover it at an time with a tool like photorec.

Quote:
Originally Posted by newbiesforever View Post
and didn't need defragging.
What you're seeing has nothing to do with fragmentation.

Last edited by suicidaleggroll; 11-30-2015 at 02:44 PM.
 
Old 11-30-2015, 03:15 PM   #8
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Abingdon, VA
Distribution: Catalina
Posts: 9,374
Blog Entries: 37

Rep: Reputation: Disabled
inodes: the Dewey Decimal System of the Linux world.

Last edited by Habitual; 11-30-2015 at 03:23 PM.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to restore deleted files from a FAT32 partition? duplex Linux - Software 12 04-08-2013 09:32 AM
how to recover files from a deleted partition?? hamidhqs Linux - Software 1 06-20-2012 05:17 AM
Disk full. Deleted files but no space available. atrejo Linux - General 3 05-03-2010 02:00 PM
deleted linux partition adn the boot loader was deleted also,now i have only gnu grub boris199 Linux - Laptop and Netbook 2 01-29-2005 04:53 PM
Recover deleted files from a Win partition in Linux? PenguinPwrdBox Linux - General 3 08-03-2004 04:05 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 09:14 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration