4 ms·

Also, wouldn't it be possible to recover the files on most filesystems, assuming the disk is too not full? The program has to encrypt them, unlink the files, a

• kazinator 12y ago
  The problem is that "needs more space later" can occur as soon as the malware moves on to the next file to encrypt. Also, overwriting discarded files can happen even before the filesystem runs out of space; it depends on the allocation strategy. To maximally preserve the possibility of undeleting files, there would have to be a policy of using the least recently freed blocks for new allocation. That could be pessimistic in other regards, like minimizing fragmentation and seek time.