cleaning tracks

vboulytchev · 03-02-2007, 10:42 AM

Gents,
From time to time mediocre users like me, want to brush up on cleaning up your tracks on a filesystem.

1.) if you rm a file, I am pretty sure it just deletes the inode, am I correct?

how would one do some deaper cleaining of the drive? How would one restore any files that were wrongfully rmed.

2.) Bash history. I am only aware of .bash_history file, which collects your last commands, which can be cleared via "history -c" command. Now, which other files collect the same information?

THANKS!

Matir · 03-02-2007, 11:17 AM

Unless your system administrator has specifically set up other logs, or you execute commands that use elevated privilege levels, the .bash_history file is the only place the bash shell will log your commands.

RMing a file only removes the pointer to the block(s) that contained the file. Overwriting the block would be necessary to ensure it is harder to recover the deleted file.

live_dont_exist · 03-02-2007, 12:21 PM

Just to add to what Matir said incase you want to recover files tha you rm -rf'd I guess you'll need a data recovery tool. There's a really cool tool called testdisk which recovered files from an entire NTFS partition for me once.Installers available for Linux as well...thats where I ran it from .. obviously

Cheers
Arvind