How does "rm" on a NTFS filesystem differs from Window's own implementation?

Posted by DavideRossi on Ask Ubuntu See other posts from Ask Ubuntu or by DavideRossi
Published on 2011-11-13T15:14:30Z Indexed on 2011/11/13 18:06 UTC
Read the original article Hit count: 271

Filed under:
|
|

I have an external USB disk with an NTFS filesystem on it.

If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").

If I remove the file from Linux no utility (unless I use a deep-search signature-based one) can recover the file. Why? How is unlink implemented in Linux's NTFS file system code? It looks like it does not just "mark it as undeleted" but it wipes away some on-disk structure, is this the case?

© Ask Ubuntu or respective owner

Related posts about filesystem

Related posts about ntfs