The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > Special Forums > UNIX Desktop for Dummies Questions & Answers
Google UNIX.COM


UNIX Desktop for Dummies Questions & Answers Questions regarding GNOME, KDE, CDE, Open Office, etc go here. All UNIX and Linux Newbies Welcome !!

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Splitting input files into multiple files through AWK command arund_01 Shell Programming and Scripting 3 05-13-2008 06:17 AM
Find duplicates from multuple files with 2 diff types of files ricky007 Shell Programming and Scripting 2 03-04-2008 09:46 AM
unzip particular gzip files among the normal data files thepurple Shell Programming and Scripting 4 11-30-2007 07:17 AM
when I try to run rm on multiple files I have problem to delete files with space umen UNIX for Dummies Questions & Answers 1 09-20-2005 12:20 AM
text files, ASCII files, binary files and ftp transfers Perderabo Answers to Frequently Asked Questions 0 04-08-2004 01:25 PM

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 06-06-2002
Registered User
 

Join Date: Jun 2002
Posts: 2
Undeleting files....

I have deleted some files from my system. If I have deleted them is there any way to retrieve them? Now if they are retrievible how do I delete them for good? In other words get rid of them forever?
Reply With Quote
Forum Sponsor
  #2 (permalink)  
Old 06-06-2002
LivinFree's Avatar
Goober Extraordinaire
 

Join Date: Jul 2001
Location: Portland, OR, USA
Posts: 1,584
Well, it's quite a quandry...
If you deleted them, for them to be recoverable to you, if almost surely too much trouble to get them back. You could search the raw disk for text strings to try, but no guarantees (if your admin will even let you).

Now - if you've done something naughty and don't want anyone to find out, it's a different story. Once again, for the end user (non-BOfH admin types) it's not worth it or they don't know how. But if you committed a crime, it's very very hard to completely erase all traces of that. The federal goverment is very determined to get your data out so it can use it against you in court. Even if overwritten many time, patterns can be found inbetween tracks on your HD using special hardware / software combos. You could try running a utility like "wipe" or "bcwipe" and running at least 50 passes with random data, then zero it out, then do the same with the slack space on your files (look for a tool called bmap for Linux, any other Unix, and I think you're SOL) then delete them. No guarantees, either...

Remember mafiaboy (the canadian kid that DDOS'ed CNN, Yahoo, and other big guys)? He threw his harddrive into a lake, where it sat for months. The feds still got data off of it.
Kevin Poulson? He encrypted his files anywhere between 2 and 5 times, then deleted them - the feds got some data out of it...
Reply With Quote
  #3 (permalink)  
Old 06-07-2002
Registered User
 

Join Date: Jun 2002
Posts: 2
Thanks for the information. I haven't done anything bad so I just wanted to know because I am starting to work with people in the Unix environment and would like to know some tips. Thanks again...
Reply With Quote
  #4 (permalink)  
Old 05-06-2006
Registered User
 

Join Date: May 2006
Posts: 1
Awww Crap! I deleted a symlinked file and wanted to get it back...... ah, no such luck. At any rate, wouldn't the easiest way to delete the data that you want gone be to open the file, overwrite the contants, save it, delete it, and then overwrite the drive? I've heard of people overwriting several times and like you mention LivinFree, the authorities have been able to recover some of the data. The thing that I'm curious about though, is that if I'm able to overwrite my drive and they are still able to find something, not that I've got anything to hide, but if that's the case, then how is the drive able to store anything at all? It would seem to me that due to the drives being composed of basically the same thing as a video or cassette tape, that once it's been overwritten the data that was there simply no longer is. Maybe that's vastly oversimplified, but if the contents were still there, then when you tape 24 over with the Sopranos, you'd have Tony Soprano saving the nation.

What you are saying is there's a residual amount of data left behind. The problem as I see it, is that on the computer, if I fill my drive and open a text document, then the text shouldn't be exactly as it were before. That doesn't jive. Can you fill me in more?
Reply With Quote
  #5 (permalink)  
Old 05-18-2006
Registered User
 

Join Date: Aug 2005
Location: Saskatchewan
Posts: 923
Quote:
Originally Posted by devriest
The thing that I'm curious about though, is that if I'm able to overwrite my drive and they are still able to find something, not that I've got anything to hide, but if that's the case, then how is the drive able to store anything at all? It would seem to me that due to the drives being composed of basically the same thing as a video or cassette tape, that once it's been overwritten the data that was there simply no longer is. Maybe that's vastly oversimplified, but if the contents were still there, then when you tape 24 over with the Sopranos, you'd have Tony Soprano saving the nation.
Hard drives do a lot of signal processing for you that you aren't aware of, filtering noise and such. To use your hypothetical example, the hard drive would normally filter out 24 and just give you the Soprano's -- telling them apart is easy since the signals are digital, it can take the strong signal and TOTALLY ignore the weak one. But if that "noise" is what you're actually looking for, finding it is possible, given a great deal of effort and expensive custom hardware. It's certainly not easy. It's more like forensics.

Not to mention that VCR's aren't the same as hard drives. VCR's have a whole seperate head for erasing the tape before it's recorded on.

Just overwriting the file isn't guaranteed to even overwrite the same sectors, by the way. It depends on the way the filesystem works. For instance, Journaling Flash FileSystem -- JFFS -- is specifically designed to not use the same sectors over and over, so as to not prematurely wear out flash media.

Last edited by Corona688; 05-18-2006 at 08:44 AM.
Reply With Quote
Google UNIX.COM
Reply

Thread Tools
Display Modes




All times are GMT -7. The time now is 07:04 AM.


Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited.
The UNIX and Linux Forums Content Copyright ©1993-2008 The CEP Blog All Rights Reserved -Ad Management by RedTyger Visit The Global Fact Book

Content Relevant URLs by vBSEO 3.2.0