3 ms·
You’re in for a rude awakening then with most file systems then. Delete just means “unlink the pointer to it in the file system” for the vast majority of file s
by Kirby64 2y ago
You’re in for a rude awakening then with most file systems then. Delete just means “unlink the pointer to it in the file system” for the vast majority of file systems. It might get deleted when it gets overwritten… sometime in the future maybe. I assume this is exactly what happened here.
- akr4s1a 2y agoHasn't been that way in a decade. If you use nand flash there's a huge chance you're using trim which will periodically overwrite "not in use" blocks to avoid a write penalty later as writing to an empty page is much quicker.
- Nextgrid 2y agoHowever, "unlink the pointer" has been good enough for ages. The data is effectively deleted short of an application having the privileges to read the underlying raw block device and having an understanding of the raw filesystem structures to be able to search though that unallocated, raw space and reconstruct file entries. No application outside of special-purpose data recovery apps (and even then you'd need to run them with elevated privileges) would have any reason to be capable of this, so in practice a deleted file means it is deleted from the perspective of the vast majority of applications. Similarly, SSD TRIM is also irrelevant - TRIM'med space is hidden from the host. Sure, an intentional tool exploiting some undocumented vendor command or side-channel could probably recover it but again you'd have to do this intentionally.