LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Puppy (https://www.linuxquestions.org/questions/puppy-71/)
-   -   Photorec - does not make sense (https://www.linuxquestions.org/questions/puppy-71/photorec-does-not-make-sense-4175573806/)

Fixit7 03-02-2016 07:33 PM

Photorec - does not make sense
 
I used Photorec and it recovered over 20 Gb of files.

But my whole installation is only 11 Gb.

What's up with that ? :-)

frankbell 03-02-2016 08:38 PM

Files that are "deleted" are not actually deleted; the pointers to them are removed. Data remains on the drive until it is overwritten by newer files. As photorec looks at data on the hard drive, it may recover all or parts of files that the system considers "deleted," that is, used space available for reuse.

This article goes into greater depth. http://www.webopedia.com/DidYouKnow/...eted_Files.asp

Fixit7 03-02-2016 08:58 PM

Interesting, similar to what Windows does.

If I want to make sure files are unrecoverable, what would I do ?

I saw shredders, but I would like a method that is not specific to one file.

In Windows, a defrag would do that, but the ext3 system does not need defragging.

yancek 03-02-2016 09:28 PM

Most every Linux has the shred command. Details on what it does at the link below.

http://www.techrepublic.com/blog/lin...es-with-shred/

descendant_command 03-02-2016 11:49 PM

Code:

dd if=/dev/zero of=/bigfatfile
rm /bigfatfile

Repeat for each filesystem you want to 'clean'.

Fixit7 03-04-2016 03:08 PM

Tried it on a flash drive.

Photorec recovered files after it was run ??

How do I know when it has finished ?

descendant_command 03-04-2016 03:41 PM

Quote:

Originally Posted by Fixit7 (Post 5510298)
Tried it on a flash drive.

Photorec recovered files after it was run ??

So you stopped it before it finished?
Quote:


How do I know when it has finished ?
When it stops.

273 03-04-2016 03:45 PM

Shred ought to USB flash drive, if that's what you mean? If you're referring to an SSD it ought to also and there's the fstrim command to wipe free space.
I believe that, for spinning drives, shred can be set to clear non-used space also.
The key to any of this though is to think about this before you start using a drive and set things up so that it's easier to ensure all data is removed. There's no use, for example, in simply reformating the disk you're suing and installing again from scratch as the remnants of all old files not written over will still be there.
So, take a step back: How did your drive get into the state it is in? How would you like it to be? What type of drive is it? How can people here help?

Fixit7 03-04-2016 03:58 PM

I just want to make deleted files unrecoverable.

These also did not work.

Quote:

fallocate -l 10G gentoo_root.img

truncate -s 10M output.file
Looks like I will have to write a file the same size as the flash drive's capacity.

273 03-04-2016 04:00 PM

Did you use shred?

descendant_command 03-04-2016 04:04 PM

Quote:

Originally Posted by Fixit7 (Post 5510327)
Looks like I will have to write a file the same size as the flash drive's capacity.

Which is precisely what the dd command does.

273 03-04-2016 04:10 PM

Quote:

Originally Posted by descendant_command (Post 5510332)
Which is precisely what the dd command does.

I don't think writing zeros over a file does anything on a flash drive, or an SSD. Something to do with wear-limiting and not making unneeded writes.
Edit: Oh, there's also that fact that even on a spinny disk where the data is gone the file record will sti;l be there so potorec might still see that?

John VV 03-04-2016 04:16 PM

shred or "srm" ( there are two different versions of this program )

srm is "secure rm "

but on a journaled file system shred or srm might not work

using dd to make a all zero .bin file and fill up the drive will remove files that are still there after shred,srm, or delete

or

really overwrite things with images
grab hundreds of G rated images from google -- random images

and copy them a few times and recopy that , then recopy that
very soon you will have 50 gigs then 100 gigs then 200 gigs

Fixit7 03-04-2016 04:26 PM

Quote:

Originally Posted by 273 (Post 5510335)
I don't think writing zeros over a file does anything on a flash drive, or an SSD. Something to do with wear-limiting and not making unneeded writes.
Edit: Oh, there's also that fact that even on a spinny disk where the data is gone the file record will sti;l be there so potorec might still see that?

It actually made deleted files unrecoverable by writing over the entire disk space.

Photorec could find nothing to recover. :-)

Less than 10 minutes to write a 4 Gb file.

273 03-04-2016 04:33 PM

Quote:

Originally Posted by Fixit7 (Post 5510344)
It actually made deleted files unrecoverable by writing over the entire disk space.

Photorec could find nothing to recover. :-)

Less than 10 minutes to write a 4 Gb file.

Thanks. This is bringing back memories of a similar thread and I've a feeling that the actual flash cells aren't changed but as long as they're not removed form the device the files can't be seen. Sorry, my memory isn't what it was.


All times are GMT -5. The time now is 03:47 AM.