Are delete files undeleted?

thrustan · 03-09-2005, 12:52 AM

i am a former windows user. and when i delete files from the recycle bin, it can easily be recovered with the aid of a programme.

now, can this be done with linux? does linux delete my files for good or do they stay in my hdd and can be recoverd?

slackie1000 · 03-09-2005, 03:31 AM

hi there,

this is a complex question. if you use gnome/kde you can setup them to put the things that you erase in the trash - through a filemanager. but once you give at the terminal

Code:

rm $FILE

it is gone.
there are some apps that can recover but this is filesystem depedent also.
to get a complete and correct answer it is necessary a google tour.

regards

slackie1000

Capt_Caveman · 03-09-2005, 07:32 AM

Also take a look at unSpawn's Security references thread, in particular post 5 has entire section of undelete tools and guides.

Aeiri · 03-09-2005, 12:57 PM

If the file is text only, there are methods you can use to retreive it.

You have to remember part of the file, say it contained "jahjoopisthespeakerforelmo". This would be a decent way to recover it, given that it had 100 lines, and resided on /dev/hda1. The results would have to be edited with an editor to clean up all the crap around it, though.

Code:

#!/bin/sh
linecount="100"
string="jahjoopisthespeakerforelmo"
partition="/dev/hda1"
outputfile="bobjones"

cat $partition | strings | grep -$linecount "$string" | tee $outputfile

Simple, but effective. I've used similar methods to bail me out of tight situations in the past

Aeiri · 03-09-2005, 01:06 PM

Oh, and if you want to securely delete something, or securely wipe a filesystem, this would be the method:

Code:

#!/bin/sh
filewipe="bobjones_file"
wipetimes="5"

stuff="/dev/zero /dev/urandom"
blah=""
i=1
while [ "$i" -le "$wipetimes" ]; do
  blah="$stuff $blah"
  let "i+=1"
done
blah=`echo ${blah:0:${#blah}-2}`

for wipe in blah; do
  dd if=$wipe of=$filewipe
done

Someone correct me if I'm wrong, I believe that using dd with only an input file and and output file will only go to the end of the output file and quit, correct?