I have an external USB disk with an NTFS filesystem on it.

If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").

If I remove the file from Linux no utility (unless I use a deep-search signature-based one) can recover the file. Why? How is unlink implemented in Linux's NTFS file system code? It looks like it does not just "mark it as deleted" but it wipes away some on-disk structure, is this the case?

  • 2
    @Jay silly_evarlast Wren You're probably right, I'll try with serverfault. The system I used for testing this behavior is an ubuntu, so this could be ubuntu-related.
    – DavideRossi
    Commented Nov 14, 2011 at 8:09
  • You could go through the source code of ntfs-3g and see if there is anything about your issue. Commented Dec 3, 2011 at 11:48
  • Maybe asking the ntfs-3g developers is a possibility too (they know how NTFS works and how they implement it).
    – JanC
    Commented Dec 11, 2011 at 19:47

2 Answers 2


I had a look at the ntfs3g source out of curiosity.

There seems to be a function ntfs_delete(...) defined in dir.c, which does the deleting.

It definitely removes all of the deleted file/directory's metadata from the filesystem structures.

Since there is the source code for Microsoft's own version is not available, I can only try to make an educated guess how it performs deletion.

It seems, that Microsoft only marks the MFT entry as unused, since the undelete utilities are able to recover the location and the name of the deleted file.


I don't know the specificities of Windows and NTFS, but a common way of doing this on Unix/Linux file manager GUIs and Mac OS X Finder is to not actually delete the file but move it to a special hidden folder named Trash (or similar). the undelete command retrieves the file from that Trash folder.

rm simply removes the file without bothering with Trash folders, as requested by the user.

  • Thanks, I've been looking for an explanation of that behavior!
    – jcora
    Commented Mar 30, 2013 at 12:22

You must log in to answer this question.