Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have an external USB disk with an NTFS filesystem on it.

If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").

If I remove the file from Linux no utility (unless I use a deep-search signature-based one) can recover the file. Why? How is unlink implemented in Linux's NTFS file system code? It looks like it does not just "mark it as deleted" but it wipes away some on-disk structure, is this the case?

share|improve this question
2  
@Jay silly_evarlast Wren You're probably right, I'll try with serverfault. The system I used for testing this behavior is an ubuntu, so this could be ubuntu-related. –  DavideRossi Nov 14 '11 at 8:09
    
You could go through the source code of ntfs-3g and see if there is anything about your issue. –  queueoverflow Dec 3 '11 at 11:48
    
Maybe asking the ntfs-3g developers is a possibility too (they know how NTFS works and how they implement it). –  JanC Dec 11 '11 at 19:47
add comment

migrated from askubuntu.com Dec 19 '11 at 11:05

This question came from our site for Ubuntu users and developers.

2 Answers

I had a look at the ntfs3g source out of curiosity.

There seems to be a function ntfs_delete(...) defined in dir.c, which does the deleting.

It definitely removes all of the deleted file/directory's metadata from the filesystem structures.

Since there is the source code for Microsoft's own version is not available, I can only try to make an educated guess how it performs deletion.

It seems, that Microsoft only marks the MFT entry as unused, since the undelete utilities are able to recover the location and the name of the deleted file.

share|improve this answer
add comment

I don't know the specificities of Windows and NTFS, but a common way of doing this on Unix/Linux file manager GUIs and Mac OS X Finder is to not actually delete the file but move it to a special hidden folder named Trash (or similar). the undelete command retrieves the file from that Trash folder.

rm simply removes the file without bothering with Trash folders, as requested by the user.

share|improve this answer
    
Thanks, I've been looking for an explanation of that behavior! –  akled Mar 30 '13 at 12:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.