16

I have an external USB disk with an NTFS filesystem on it.

If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").

If I remove the file from Linux no utility (unless I use a deep-search signature-based one) can recover the file. Why? How is unlink implemented in Linux's NTFS file system code? It looks like it does not just "mark it as deleted" but it wipes away some on-disk structure, is this the case?

migrated from askubuntu.com Dec 19 '11 at 11:05

This question came from our site for Ubuntu users and developers.

  • 2
    @Jay silly_evarlast Wren You're probably right, I'll try with serverfault. The system I used for testing this behavior is an ubuntu, so this could be ubuntu-related. – DavideRossi Nov 14 '11 at 8:09
  • You could go through the source code of ntfs-3g and see if there is anything about your issue. – Martin Ueding Dec 3 '11 at 11:48
  • Maybe asking the ntfs-3g developers is a possibility too (they know how NTFS works and how they implement it). – JanC Dec 11 '11 at 19:47
7

I had a look at the ntfs3g source out of curiosity.

There seems to be a function ntfs_delete(...) defined in dir.c, which does the deleting.

It definitely removes all of the deleted file/directory's metadata from the filesystem structures.

Since there is the source code for Microsoft's own version is not available, I can only try to make an educated guess how it performs deletion.

It seems, that Microsoft only marks the MFT entry as unused, since the undelete utilities are able to recover the location and the name of the deleted file.

3

I don't know the specificities of Windows and NTFS, but a common way of doing this on Unix/Linux file manager GUIs and Mac OS X Finder is to not actually delete the file but move it to a special hidden folder named Trash (or similar). the undelete command retrieves the file from that Trash folder.

rm simply removes the file without bothering with Trash folders, as requested by the user.

  • Thanks, I've been looking for an explanation of that behavior! – jcora Mar 30 '13 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy