[SOLVED] why is my Linux partition full of deleted files?
Linux - GeneralThis Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
An important file somehow became completely corrupted; and I had backed it up without knowing it was corrupted, so the backup was useless. I ran photorec, looking for a deleted version to restore from. I found most or all of what I needed, but to my surprise, I also found close to ten thousand deleted files of various types. Why do I have a very large number of deleted files? I thought Linux filesystems didn't leave very many deleted files, if any, and didn't need defragging.
When a file is deleted, its data blocks and its metadata, often contained in a datastructure named "inode" (the name depends on the filesystem) are simply marked as unused. If they are not reused, they stay like this, and forensic tools like photorec find them.
Distribution: Debian Sid AMD64, Raspbian Wheezy, various VMs
Posts: 7,680
Rep:
How long have you had the drive and what, if anything, have you used it for prior to installing Linux. In theory, if you've had the drive 10 years and installed multiple OSs on it you may have "deleted" files still on it going back 10 years to the first OS install, for example.
Distribution: Debian Sid AMD64, Raspbian Wheezy, various VMs
Posts: 7,680
Rep:
What I was trying to say is that the files you found could have been created at any point during the life of the drive, since files are not actually deleted unless you use a "shredder". So unless you have wiped every sector of your drive there is no telling where the file headers found came from.
Fragmentation is when you have bits of current files scattered all over the place, with a lot of little gaps that are too small to use. The "files" detected by photorec are areas on the HD that contain bytes that were obviously once part of a file. From the point of the filing system, those bytes might as well be nulls: it knows nothing about them and will overwrite them automatically whenever it needs to. The problem with photorec is that it can't look for details of deleted files in the directories, as Linux completely removes them: it has to just hunt right through the HD, looking for any blocks of code on the off-chance that they might be files.
The moral is to always make alternate backups on different media: if my blue medium has a corrupted file, the pink one may well be OK.
Why do I have a very large number of deleted files?
Because you and your OS have apparently deleted/modified a large number of files, which is perfectly normal. Think of how many intermediate files get created/deleted from a simple system update, and multiply that by several years.
Quote:
Originally Posted by newbiesforever
I thought Linux filesystems didn't leave very many deleted files, if any
Linux, like OSX and Windows, does not clean up deleted files automatically. When a file is deleted, it's not actually wiped from the drive, the reference to it is simply removed and those blocks are free to be overwritten whenever the space is needed. If the blocks are never overwritten, then the file never actually disappears from the drive platters, and you can recover it at an time with a tool like photorec.
Quote:
Originally Posted by newbiesforever
and didn't need defragging.
What you're seeing has nothing to do with fragmentation.
Last edited by suicidaleggroll; 11-30-2015 at 02:44 PM.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.