UNIX Desktop Questions & Answers

I have deleted some files from my system. If I have deleted them is there any way to retrieve them? Now if they are retrievible how do I delete them for good? In other words get rid of them forever?

Well, it's quite a quandry...
If you deleted them, for them to be recoverable to you, if almost surely too much trouble to get them back. You could search the raw disk for text strings to try, but no guarantees (if your admin will even let you).

Now - if you've done something naughty and don't want anyone to find out, it's a different story. Once again, for the end user (non-BOfH admin types) it's not worth it or they don't know how. But if you committed a crime, it's very very hard to completely erase all traces of that. The federal goverment is very determined to get your data out so it can use it against you in court. Even if overwritten many time, patterns can be found inbetween tracks on your HD using special hardware / software combos. You could try running a utility like "wipe" or "bcwipe" and running at least 50 passes with random data, then zero it out, then do the same with the slack space on your files (look for a tool called bmap for Linux, any other Unix, and I think you're SOL) then delete them. No guarantees, either...

Remember mafiaboy (the canadian kid that DDOS'ed CNN, Yahoo, and other big guys)? He threw his harddrive into a lake, where it sat for months. The feds still got data off of it.
Kevin Poulson? He encrypted his files anywhere between 2 and 5 times, then deleted them - the feds got some data out of it...

Thanks for the information. I haven't done anything bad so I just wanted to know because I am starting to work with people in the Unix environment and would like to know some tips. Thanks again...

Awww Crap! I deleted a symlinked file and wanted to get it back...... ah, no such luck. At any rate, wouldn't the easiest way to delete the data that you want gone be to open the file, overwrite the contants, save it, delete it, and then overwrite the drive? I've heard of people overwriting several times and like you mention LivinFree, the authorities have been able to recover some of the data. The thing that I'm curious about though, is that if I'm able to overwrite my drive and they are still able to find something, not that I've got anything to hide, but if that's the case, then how is the drive able to store anything at all? It would seem to me that due to the drives being composed of basically the same thing as a video or cassette tape, that once it's been overwritten the data that was there simply no longer is. Maybe that's vastly oversimplified, but if the contents were still there, then when you tape 24 over with the Sopranos, you'd have Tony Soprano saving the nation.

What you are saying is there's a residual amount of data left behind. The problem as I see it, is that on the computer, if I fill my drive and open a text document, then the text shouldn't be exactly as it were before. That doesn't jive. Can you fill me in more?

Hard drives do a lot of signal processing for you that you aren't aware of, filtering noise and such. To use your hypothetical example, the hard drive would normally filter out 24 and just give you the Soprano's -- telling them apart is easy since the signals are digital, it can take the strong signal and TOTALLY ignore the weak one. But if that "noise" is what you're actually looking for, finding it is possible, given a great deal of effort and expensive custom hardware. It's certainly not easy. It's more like forensics.

Not to mention that VCR's aren't the same as hard drives. VCR's have a whole seperate head for erasing the tape before it's recorded on.

Just overwriting the file isn't guaranteed to even overwrite the same sectors, by the way. It depends on the way the filesystem works. For instance, Journaling Flash FileSystem -- JFFS -- is specifically designed to not use the same sectors over and over, so as to not prematurely wear out flash media.