Recovering deleted files from ext3 [LWN.net]

Recovering deleted files from ext3

Posted Mar 16, 2008 12:39 UTC (Sun) by dlang (guest, #313)
In reply to: Recovering deleted files from ext3 by elgordo123
Parent article: Recovering deleted files from ext3

please explain.

if you were ever under the impression that any linux filesystem completely overwrote the file
with zeros (let alone did a secure delete by overwriting the file multiple times with
different patterns), you are sadly mistaken.

it's still significantly harder to recover files from ext2 than it is from windows file
systems, but that's not a security measure, and it never was.

Recovering deleted files from ext3

Posted Mar 18, 2008 23:45 UTC (Tue) by jquirk (guest, #51079) [Link]

Ext2 is not really that hard to recover files from provided you stop and unmount the disk as
soon as you realize you have a problem. Its all there have a look at my stuff I contributed to
LDE you can see all deleted entries on ext2 volume, ext2 just unlinks the directory entry for
a linked list, marks the inode as deleted and frees the blocks in the bit map. It is as you
stated ext2 zeros nothing of value. Most forensics tools know this so if you are security
concerned standard files system are not for you. Ever wonder why if purchase you ex military
computers they have no hard drives.