Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Are Shift+Delete and rm -rf different? Is it possible to recover deleted data after performing either of them?

share|improve this question
add comment

3 Answers

Of course in form they are very different but accomplish the same task. You should read the man page for rm (run man rm) so you understand what the options actually mean. The -r argument to the rm command refers to "recursive", meaning that not just the object you specifiy but any subfolders will also be deleted. The -f is for force, which means it doesn't ask you to verify anything. The rm command never sends anything "to trash" or otherwise moves it, that would be for the mv command to do. It just deletes it.

I assume when you say Shift+Delete you are refering to a graphical file manager such as nautilus. The shift prefix usually indicates you want to skip the saftey "move to trash" kind of function and just execute the delete already.

In both cases the file nodes are REMOVED. Usually the file data still exists on the disk in magnetic ones and zeros, but the information about where they are is removed and the space becomes over-writable, so anything you do with the disk after that will start using the space. Some disk recovery utilities can try to find scraps of old files that haven't been fully over-written yet, but it's kind of an inexact science.

The second half of your question comes up quite frequently. Here are some similar questions here that go into the details:

And also on ServerFault:

share|improve this answer
add comment

Removing a file is like tearing up a sheet of paper and throwing the pieces into a garbage can.

It's not going to be recoverable in any comfortable or reliable way. By the time you go looking for the pieces, the garbage can may well have been emptied (the operating system does this at its convenience). The pieces may now be on a rubbish tip somewhere. Some pieces may have been picked up by birds to make nest or incinerated. Or else the pieces may have been bleached and turned into recycled paper. Even if all the pieces are still there, you'll have a hard time locating them and reassembling them.

For confidentiality purposes however, deletion isn't secure against someone who has access to your garbage can (i.e. someone who steals your hard disk). They may still be able to find traces of what you've been doing. Of course, if the files are encrypted, whatever the spy passing as a maid finds in the garbage can won't be of much use to her.

In short: for security, assume deleted files are still readable. For data recovery, assume deleted files are gone.

share|improve this answer
    
You can't have your cake and eat it too, but you can definitively loose your cake and somebody else eats it :) –  Caleb Jun 24 '11 at 6:04
add comment

In effect they are not different. They delete files without moving them to virtual trash can. Recovering the files might be possible, depending the file system used.

Most likely the data will remain on the disk until you write something else over them, so ensure that nothing is written on the disk immediately after you realize your mistake. You can remount the file system read-only or boot with a livecd/usb.

If it is NTFS or FAT file system, you have a good chance to recover them. If it is ext3/4, then you probably lost them forever. Check this tool and also this answer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.