Are Shift+Delete and rm -rf different? Is it possible to recover deleted data after performing either of them?
Asked
Active
Viewed 4,210 times
2
3 Answers
8
Of course in form they are very different but accomplish the same task. You should read the man page for rm (run man rm) so you understand what the options actually mean. The -r argument to the rm command refers to "recursive", meaning that not just the object you specifiy but any subfolders will also be deleted. The -f is for force, which means it doesn't ask you to verify anything. The rm command never sends anything "to trash" or otherwise moves it, that would be for the mv command to do. It just deletes it.
I assume when you say Shift+Delete you are refering to a graphical file manager such as nautilus. The shift prefix usually indicates you want to skip the saftey "move to trash" kind of function and just execute the delete already.
In both cases the file nodes are REMOVED. Usually the file data still exists on the disk in magnetic ones and zeros, but the information about where they are is removed and the space becomes over-writable, so anything you do with the disk after that will start using the space. Some disk recovery utilities can try to find scraps of old files that haven't been fully over-written yet, but it's kind of an inexact science.
The second half of your question comes up quite frequently. Here are some similar questions here that go into the details:
- Where do files go when the rm command is issued?
- Recovering deleted files on fedora
- Do we have an undo in Linux?
- How to recover a missing file
And also on ServerFault:
3
Removing a file is like tearing up a sheet of paper and throwing the pieces into a garbage can.
It's not going to be recoverable in any comfortable or reliable way. By the time you go looking for the pieces, the garbage can may well have been emptied (the operating system does this at its convenience). The pieces may now be on a rubbish tip somewhere. Some pieces may have been picked up by birds to make nest or incinerated. Or else the pieces may have been bleached and turned into recycled paper. Even if all the pieces are still there, you'll have a hard time locating them and reassembling them.
For confidentiality purposes however, deletion isn't secure against someone who has access to your garbage can (i.e. someone who steals your hard disk). They may still be able to find traces of what you've been doing. Of course, if the files are encrypted, whatever the spy passing as a maid finds in the garbage can won't be of much use to her.
In short: for security, assume deleted files are still readable. For data recovery, assume deleted files are gone.
Gilles 'SO- stop being evil'
- 829,060
-
You can't have your cake and eat it too, but you can definitively loose your cake and somebody else eats it :) – Caleb Jun 24 '11 at 06:04
1
In effect they are not different. They delete files without moving them to virtual trash can. Recovering the files might be possible, depending the file system used.
Most likely the data will remain on the disk until you write something else over them, so ensure that nothing is written on the disk immediately after you realize your mistake. You can remount the file system read-only or boot with a livecd/usb.
If it is NTFS or FAT file system, you have a good chance to recover them. If it is ext3/4, then you probably lost them forever. Check this tool and also this answer.
