Re: Suggestion for rm(1)

[Bob Proulx]

Keisial wrote:
> Reuben Thomas wrote:
>> I am also trying to convey the fact that an expert can offer recover
>> deleted data quickly *and* easily.
>
> Can him?
> It largely depends on filesystem and content characteristics, but I don't
> think that's "easy for experts".

At the time that original text in the rm man page was written I think
we were all using older filesystems to which that statement applied.
Filesystems such as the commercial ones or the new free ext2 were the
common use then and there certainly were tools to recover files.

But as time has passed I think the logic of it has flipped.  Now
almost everyone uses a journaling filesystem.  Now probably the most
common filesystem used by people is the ext3 with ext4 becoming more
popular in the future.  (Not to slight xfs and others. :-) In ext3 as
I understand it (http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html)
this is much more difficult because the block pointers are zero'd out.

As I understand it you can only wade through the see of possibly gigs
of raw data and maybe snag blocks that haven't been reused.  You would
have to manually decide that certain data lined up with other certain
data to form a particular file and the order and if you got all of it
or not.  That would be very tedious for most computer users today.
And if the filesystem is active then probably impossible as the blocks
are reused.

But of course since it might be possible to recover something if you
are willing to go the to the effort[1] then those really trying to
prevent the data from being accessed need to do more than just remove
it.

Bob

[1] http://en.wikipedia.org/wiki/Project_Azorian