How does "rm" on a NTFS filesystem differs from Window's own implementation?
Posted
by
DavideRossi
on Ask Ubuntu
See other posts from Ask Ubuntu
or by DavideRossi
Published on 2011-11-13T15:14:30Z
Indexed on
2011/11/13
18:06 UTC
Read the original article
Hit count: 271
I have an external USB disk with an NTFS filesystem on it.
If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").
If I remove the file from Linux no utility (unless I use a deep-search signature-based one) can recover the file. Why? How is unlink implemented in Linux's NTFS file system code? It looks like it does not just "mark it as undeleted" but it wipes away some on-disk structure, is this the case?
© Ask Ubuntu or respective owner