4 ms·

Someone had ran RM * on their shared storage, deleting the file system. They were "saved" by someone having a copy of the movie on their PC at home. The data

Someone had ran RM * on their shared storage, deleting the file system. They were "saved" by someone having a copy of the movie on their PC at home. The data wasn't gone (only the file system was nuked), but would have required specialist intervention to restore. Or a hacker with the right tools (assuming such tools exist for the *nix file systems - they certainly do for fat32 and NTFS)..

azelfrath 14y ago
I would assume this would be standard forensics. Might not be tools for their particular file format, but it would be possible to carve the data.
Zirro 14y ago
"Someone had ran RM * on their shared storage, deleting the file system." Doesn't this command, like any other delete-command, require top privileges (admin/root) that are unavailable in normal situations?
- mcpherrinm 14y ago
  Presumably the people working on the film had the ability to edit the assets, and thus could delete them.
  - Zirro 14y ago
    I'm still under the impression that modifying and completely removing are different things, but perhaps it was a sloppy configuration or that they put too much trust in their employees.
    - sliverstorm 14y ago
      Depends on the filesystem. Traditional unix permissions are simply r, w, x.
      - floomp 14y ago
        If you lack write permission on the directory, you can't delete any files in it, but you can still modify them if you have write permission on the files themselves. It's an unusual configuration, but it's possible with standard Unix permissions.
      - pdw 14y ago
        In traditional Unix you can delete a file if you have write access to the containing directory. The permission bits of the file don't matter. On all (?) modern Unix variants, you can set the sticky bit on a directory to also require write access to the file.
sliverstorm 14y ago
Or a hacker with the right tools (assuming such tools exist for the nix file systems - they certainly do for fat32 and NTFS)* *nix file systems purge the file immediately, unless it is still opened by some program. fat32 deletes the entry from the file allocation table, and the data is eventually overwritten as new files fill that same location.
- scott_s 14y ago
  The metadata may be zeroed out, but I'm unaware of standard Unix file systems that will zero out the contents of the files.
  - spudlyo 14y ago
    Linux filesystems like ext(2|3|4) don't zero the contents of the data blocks, and you can use tools to recover the data.
orenjacob 14y ago
I don't recall specifically what version of *nix was being run on what hardware at that time, but I do remember talking about the fact that things (like virtual memory) were writing to the drives before we even pulled the plug on the machine. And, at that point in time, introducing more uncertainty into the restoral process wasn't going to help. There was already too much uncertainty everywhere we were looking. I'll post about that separately...

azelfrath 14y ago

I would assume this would be standard forensics. Might not be tools for their particular file format, but it would be possible to carve the data.

Zirro 14y ago

"Someone had ran RM * on their shared storage, deleting the file system." Doesn't this command, like any other delete-command, require top privileges (admin/root) that are unavailable in normal situations?

mcpherrinm 14y ago
Presumably the people working on the film had the ability to edit the assets, and thus could delete them.
- Zirro 14y ago
  I'm still under the impression that modifying and completely removing are different things, but perhaps it was a sloppy configuration or that they put too much trust in their employees.
  - sliverstorm 14y ago
    Depends on the filesystem. Traditional unix permissions are simply r, w, x.
    - floomp 14y ago
      If you lack write permission on the directory, you can't delete any files in it, but you can still modify them if you have write permission on the files themselves. It's an unusual configuration, but it's possible with standard Unix permissions.
    - pdw 14y ago
      In traditional Unix you can delete a file if you have write access to the containing directory. The permission bits of the file don't matter. On all (?) modern Unix variants, you can set the sticky bit on a directory to also require write access to the file.

sliverstorm 14y ago

Or a hacker with the right tools (assuming such tools exist for the nix file systems - they certainly do for fat32 and NTFS)* *nix file systems purge the file immediately, unless it is still opened by some program. fat32 deletes the entry from the file allocation table, and the data is eventually overwritten as new files fill that same location.

scott_s 14y ago
The metadata may be zeroed out, but I'm unaware of standard Unix file systems that will zero out the contents of the files.
- spudlyo 14y ago
  Linux filesystems like ext(2|3|4) don't zero the contents of the data blocks, and you can use tools to recover the data.

orenjacob 14y ago

I don't recall specifically what version of *nix was being run on what hardware at that time, but I do remember talking about the fact that things (like virtual memory) were writing to the drives before we even pulled the plug on the machine. And, at that point in time, introducing more uncertainty into the restoral process wasn't going to help. There was already too much uncertainty everywhere we were looking. I'll post about that separately...