Re: [gentoo-user] reiserfs undelete ?
Steven Elling wrote: Here is some fodder: Secure Deletion of Data from Magnetic and Solid-State Memory http://rootprompt.org/article.php3?article=473 Yep, something like that :) So, not being able to undelete some regularly deleted files is clearly not a filesys 'feature'. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Thu, 2003-11-27 at 23:25, Oliver Lange wrote: > Well i have read an article about a topic called 'restformatierung' (German), > which means something like 'remaining formatting'. If you physically open a > harddisk and connect it to some special diagnostics equipment, it might be > possible to find out how the magnetic particles on the disk have been before > they were overwritten to the actual state, but this is not guarateed > to work for all and every bit, and it requires very special equipment, > and AFAIK, the harddisk itself is gone forever after doing that. > > > -- > [EMAIL PROTECTED] mailing list > Here is some fodder: Secure Deletion of Data from Magnetic and Solid-State Memory Peter Gutmann Department of Computer Science University of Auckland http://rootprompt.org/article.php3?article=473 -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Thu, 27 Nov 2003 21:25:55 -0800, Oliver Lange muttered: > >It's still not deleted. If a sufficiently determinded party wants to > >recover your data, they can do it. > > Well i have read an article about a topic called 'restformatierung' > (German), > which means something like 'remaining formatting'. If you physically open a > harddisk and connect it to some special diagnostics equipment, it might be > possible to find out how the magnetic particles on the disk have been before > they were overwritten to the actual state, but this is not guarateed > to work for all and every bit, and it requires very special equipment, > and AFAIK, the harddisk itself is gone forever after doing that. That's what shred is for. Shred will overwrite a file with random data a number of times (the default is 25) to thwart this sort of attack. -- Andrew Farmer [EMAIL PROTECTED] pgp0.pgp Description: PGP signature
Re: [gentoo-user] reiserfs undelete ?
Harald Arnesen wrote: Well if i want to delete a file forever, there are many tools out there which do the job. For example, Krusader offers a "shred" command, other tools work from the console. These tools overwrite the whole file with Null-Bytes before deleting them. It's still not deleted. If a sufficiently determinded party wants to recover your data, they can do it. Well i have read an article about a topic called 'restformatierung' (German), which means something like 'remaining formatting'. If you physically open a harddisk and connect it to some special diagnostics equipment, it might be possible to find out how the magnetic particles on the disk have been before they were overwritten to the actual state, but this is not guarateed to work for all and every bit, and it requires very special equipment, and AFAIK, the harddisk itself is gone forever after doing that. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Van Eps, Nathan D. (James Tower) wrote: If you are often deleting files by accident, you should look into a solution that moves the files to a temporary folder to be deleted later. Well in 20 years of computer freakin' (from C-64 over Amiga, Windows & Linux), i can remember only about 4-5 times where i accidently deleted (a) file(s). But *if* it happened, i always had my recovery tools ready to go, no matter on which platform or fs. I've never really lost anything in my life, as far as i remember. Using a trashcan means extra work (deleting trash by hand), especially when big files are deleted every day (cd images, archives, movies etc.), which i don't want to hang around in the trashcan, filling up my harddisk. However, my question has been answered: there's nothing for reiserfs at the moment except that recover-all operation mentioned earlier, which is a solution for the very-rare-but-very-critical case. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Oliver Lange <[EMAIL PROTECTED]> wrote: > Phil Sexton wrote: >>>Someone with more technical backround (less lazyness ;-P) would provide >>>you with a more exaustive answer, but in short you cannot undelete files >>>in a ReiserFS partition because of its very internal structure. > Oh boy, that's a clear minus point for reiserfs.. Well, then it's also a clear minus for XFS, ext3 and possibly JFS (don't know) as they all don't have an undelete feature/program. So basically every journalling FS on Linux does not have a recover utility - go figure. That's what backups are for! Undelete is a misconcept known from FAT16/FAT32. Cheers, Juri -- Juri Haberland <[EMAIL PROTECTED]> -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Norbert Kamenicky wrote: Jason Stubbs wrote: Actually, the FAT itself is just a flat array indexed by allocation unit. The data held is either a marker for empty space, a marker for the last unit in a file or a reference to the next unit. When a file is deleted, the first character in the directory entry is changed and the FAT entries are reset to empty space - all that is left is a pointer to the first unit. The reason why undelete programs work on FAT is because they have intimite knowledge of how the OS places files and that takes an educated guess at what part of the file went where. Jason Yes, but it worx safely only in case the FAT (fs ?) is not fragmented ... if clusters of files A and B are "mixed" (i.e. stored like "a1 b1 a2 b2 a3 b3", "a1 a3 a2 b1 b3 b2" etc.) and both of the files are deleted undelete will give corrupted files. Special "undelete" info (stored in extra file) must be used. noro sorry for replying myself ... -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Jason Stubbs wrote: Actually, the FAT itself is just a flat array indexed by allocation unit. The data held is either a marker for empty space, a marker for the last unit in a file or a reference to the next unit. When a file is deleted, the first character in the directory entry is changed and the FAT entries are reset to empty space - all that is left is a pointer to the first unit. The reason why undelete programs work on FAT is because they have intimite knowledge of how the OS places files and that takes an educated guess at what part of the file went where. Jason Yes, but it worx safely only in case the FAT (fs ?) is not fragmented ... if clusters of files A and B are "mixed" (i.e. stored like "a1 b1 a2 b2 a3 b3", "a1 a3 a2 b1 b3 b2" etc.) undelete will give corrupted files. Special "undelete" info (stored in extra file) must be used. noro -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Adrian Pirciu wrote: ext2 at least _can_ undelete files. the problem is searching for the specific file to undelete. The quick way: start mc (midnight commander) and in one of the menus you will find Undelete: it will search for deleted files, but they have no names, only inode numbers.. if you know the approximate size of the file, you can sort by size and use F3 to see every file and try to guess the right one..I used that and it worked fine. :-o ? really ? I made a special test (on extra ext2 FS) before about one or two years, to check if it worx ... but it worked for relatively short files ONLY ! When I erased 700MB file, it starts to "undelete" it, estimated time was cca 1 minute (nice), but after 1 hour it was 1 hour 15 minutes. After 8 hours I canceled the test, because EST was still divergent and the result was in infinity :-( The good news is, that "recover" see http://recover.sourceforge.net worked great with the same file :-) noro PS. I do not know, what really worx proper on mc. Lets's try large ftp transports (all partition), mc needs tripple the time as standard ftp :-( -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Wednesday 26 November 2003 13:55, Adrian Pirciu wrote: > On Wednesday 26 November 2003 06:35, Hemmann, Volker Armin wrote: > > If something is 'deleted' it should be gone from the fs point of > > view (like in linux). Not hidden from the user with a nifty > > charackter or in a special dir (like in dos or windows). So to > > install a tool, simple to unhidde and/or delete this hidden files > > is only a weak patch for a imho borked design. > > I now understand what you mean. Taking out of discussion the "recycle > bin" stuff, which of course can't be named deletion, I'm not sure if > the "marking" (4E in hexa if I remeber correctly) is so bad after > all. Of course, there will be records in FAT that maybe shoudn't be > there, but at least a beginner can undelete his mp3s or part of them > after a mistake. I would be tempted to say that this marking thing > was meant for beginners, but at the time when dos was created, i > doubt they designed FAT with this consideration in mind. > All in all, fat follows the windows style, and it's up to the users to > choose a file system. Actually, the FAT itself is just a flat array indexed by allocation unit. The data held is either a marker for empty space, a marker for the last unit in a file or a reference to the next unit. When a file is deleted, the first character in the directory entry is changed and the FAT entries are reset to empty space - all that is left is a pointer to the first unit. The reason why undelete programs work on FAT is because they have intimite knowledge of how the OS places files and that takes an educated guess at what part of the file went where. Jason -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wednesday 26 November 2003 06:35, Hemmann, Volker Armin wrote: > On Wednesday 26 November 2003 03:54, Adrian Pirciu wrote: > > Dude, you don't know what you're talking about, really. To delete > > a file = to mark a file "deleted". There are 2 cases: > > > > 1. just mark the file as deleted and then use the space whenever > > needed: > > - pros: speed (you just have to write a few bytes to mark a file > > for deletion, on fat systems just 1 byte afaik), undeleting stuff > > (if you are telling me that you never needed an undelete > > program.. well..) > > > > - cons: some other unwanted people might undelete stuff you don't > > want to have undeleted... > > 1b) and remove the pointers to the data thus unallocating the > inodes. So, the inodes are not marked as deleted, but marked as > unused/free space. > > > 2. delete entire file (like overwriting the space occupied by the > > deleted data it with other garbage data) > > - pros: fewer chance of undeletion (NOT null-chances, since with > > proper (expensive) equipment, somebody might still recover the > > data.. incredible isn't it ? that's why many programs let you > > choose how many times to overwrite the deleted portion ... (even > > hundreds of times) > > > > - cons: SPEED !!! if the system would have to overwrite every > > file you delete, the writing speed would be half on deletion !! > > (example: to delete 1 700MB movie on my system would take 0.01 > > sec at most for case 1 and about 20-30 secs for case2) > > and the third dos/windows FAT way: > just add a special charackter to the name and don't show it to the > user anymore, but have it still in the FAT OR shove it into the > trashcan. > > > Linux and Windows and any system which cares about itself and its > > users should use the first variant by default, letting the users > > choose if they want that kind of security like file shredded by > > other programs.. At least on ext2 it is possible to undelete > > stuff, and maybe on the others too, but nobody really cared to > > design such programs... > > in ext2 you have a bitmap of the inodes and a well known structure. > This making undelete a complicate but doable process, scanning for > unallocated inodes, checking them and dump them into lost&found. > > Reiser with its B*-trees is something different, at the latest when > you hit packed tails. > > > by the way, deleting a file will not put it in linux (by default > > at least) in "a hidden dir". The space which is marked as deleted > > can be used by the system at any time, and it appears as "free > > space" (not like windows recycle bin). > > Maybe I was not clear. > I am familar to the different ways of deleting a file. > But I think that simple renaming/shoving it into a hidden dir, can > not be called 'deleting'. Additionally there seems to be a huge > intervall between 'deleting' and 'overwriting' in windows, apart > from this 'trashcan' crap wich has nothing to do with deleting at > all. > > With linux, unmount/remounting ro could be (and in a lot of cases > will be) enough to overwrite the freed inodes. > > If something is 'deleted' it should be gone from the fs point of > view (like in linux). Not hidden from the user with a nifty > charackter or in a special dir (like in dos or windows). So to > install a tool, simple to unhidde and/or delete this hidden files > is only a weak patch for a imho borked design. I now understand what you mean. Taking out of discussion the "recycle bin" stuff, which of course can't be named deletion, I'm not sure if the "marking" (4E in hexa if I remeber correctly) is so bad after all. Of course, there will be records in FAT that maybe shoudn't be there, but at least a beginner can undelete his mp3s or part of them after a mistake. I would be tempted to say that this marking thing was meant for beginners, but at the time when dos was created, i doubt they designed FAT with this consideration in mind. All in all, fat follows the windows style, and it's up to the users to choose a file system. > > A tool to 'increase' your feeling of secured privacy may be a fine > thing, but a) after you copied some files to the partition, it > should not be necessary anymore and b) with this nice journaling > fs.. are you sure, that th write-command really hits the platters? > I am not man. > > That you can do some forensics on harddisks is a completly > different topic and if you have the money to buy the hard&software > to do that, or pay a labor to do it for you, you also have the > money for a more than decent backup solution, rendering the whole > topic useless. > > > If I didn't understand you correctly, please excuse me. > > > > On Wednesday 26 November 2003 04:33, Hemmann, Volker Armin wrote: > > > On Tuesday 25 November 2003 19:31, Oliver Lange wrote: > > > > Redeeman wrote: > > > > > its not a minus, its also a feature, sometimes if i delete > > > > > data i really want it to disappear! > > > > > >
Re: [gentoo-user] reiserfs undelete ?
On Wednesday 26 November 2003 03:54, Adrian Pirciu wrote: > Dude, you don't know what you're talking about, really. To delete a > file = to mark a file "deleted". There are 2 cases: > > 1. just mark the file as deleted and then use the space whenever > needed: > - pros: speed (you just have to write a few bytes to mark a file for > deletion, on fat systems just 1 byte afaik), undeleting stuff (if you > are telling me that you never needed an undelete program.. well..) > > - cons: some other unwanted people might undelete stuff you don't want > to have undeleted... 1b) and remove the pointers to the data thus unallocating the inodes. So, the inodes are not marked as deleted, but marked as unused/free space. > 2. delete entire file (like overwriting the space occupied by the > deleted data it with other garbage data) > - pros: fewer chance of undeletion (NOT null-chances, since with > proper (expensive) equipment, somebody might still recover the data.. > incredible isn't it ? that's why many programs let you choose how > many times to overwrite the deleted portion ... (even hundreds of > times) > > - cons: SPEED !!! if the system would have to overwrite every file you > delete, the writing speed would be half on deletion !! (example: to > delete 1 700MB movie on my system would take 0.01 sec at most for > case 1 and about 20-30 secs for case2) and the third dos/windows FAT way: just add a special charackter to the name and don't show it to the user anymore, but have it still in the FAT OR shove it into the trashcan. > Linux and Windows and any system which cares about itself and its > users should use the first variant by default, letting the users > choose if they want that kind of security like file shredded by other > programs.. At least on ext2 it is possible to undelete stuff, and > maybe on the others too, but nobody really cared to design such > programs... in ext2 you have a bitmap of the inodes and a well known structure. This making undelete a complicate but doable process, scanning for unallocated inodes, checking them and dump them into lost&found. Reiser with its B*-trees is something different, at the latest when you hit packed tails. > by the way, deleting a file will not put it in linux (by default at > least) in "a hidden dir". The space which is marked as deleted can be > used by the system at any time, and it appears as "free space" (not > like windows recycle bin). Maybe I was not clear. I am familar to the different ways of deleting a file. But I think that simple renaming/shoving it into a hidden dir, can not be called 'deleting'. Additionally there seems to be a huge intervall between 'deleting' and 'overwriting' in windows, apart from this 'trashcan' crap wich has nothing to do with deleting at all. With linux, unmount/remounting ro could be (and in a lot of cases will be) enough to overwrite the freed inodes. If something is 'deleted' it should be gone from the fs point of view (like in linux). Not hidden from the user with a nifty charackter or in a special dir (like in dos or windows). So to install a tool, simple to unhidde and/or delete this hidden files is only a weak patch for a imho borked design. A tool to 'increase' your feeling of secured privacy may be a fine thing, but a) after you copied some files to the partition, it should not be necessary anymore and b) with this nice journaling fs.. are you sure, that th write-command really hits the platters? I am not man. That you can do some forensics on harddisks is a completly different topic and if you have the money to buy the hard&software to do that, or pay a labor to do it for you, you also have the money for a more than decent backup solution, rendering the whole topic useless. > If I didn't understand you correctly, please excuse me. > > On Wednesday 26 November 2003 04:33, Hemmann, Volker Armin wrote: > > On Tuesday 25 November 2003 19:31, Oliver Lange wrote: > > > Redeeman wrote: > > > > its not a minus, its also a feature, sometimes if i delete data > > > > i really want it to disappear! > > > > > > Well if i want to delete a file forever, there are many tools out > > > there which do the job. For example, Krusader offers a "shred" > > > command, other tools work from the console. These tools overwrite > > > the whole file with Null-Bytes before deleting them. > > > > that is the same like buying a car.. and buying a second one for > > left turns... > > > > If I delete a file, I want it to be gone. Nothing else. > > > > rm means remove not 'park this in a hidden dir' or 'obfuscate the > > name'. > > > > That windows does not realy 'delete' but merely renames and > > overwrites files, is only an additional sign for windos weak > > design. Undeleting there is not a feature, but a way to exploit the > > shortenings of fat. > > > > > -- > > > [EMAIL PROTECTED] mailing list > > -- -- Conclusions In a straight-up fight, the Empire squashes the Federation like a bug. Even with its n
Re: [gentoo-user] reiserfs undelete ?
Heschi Kreinick wrote: Andrew Gaffney wrote: Matthew Baxa wrote: On Mon, 2003-11-24 at 17:11, Oliver Lange wrote: Phil Sexton wrote: Someone with more technical backround (less lazyness ;-P) would provide you with a more exaustive answer, but in short you cannot undelete files in a ReiserFS partition because of its very internal structure. Does this count? http://recover.sourceforge.net/unix/ Oh boy, that's a clear minus point for reiserfs.. Um, all the Unix filesystems (ext2, ext3, ReiserFS, XFS, JFS, UFS) have no undelete stuff. There was a program I used to use with ext2 before ext3 was big. I can't remember what it was called. You would add a 'LD_PRELINK' environment variable pointing at its dynamic lib that would override the unlink() function and move files into a protected environment. You could then run the associated utility to recover them. Also, it came with an *actual* ext2 undelete program that worked pretty well. I believe you're referring to libtrash, http://m-arriaga.net/software/libtrash/ . Not for me, but interesting idea. I was slightly wrong with my description. It doesn't move the file, but allows for easy recovery with the original filename. Its called e2undel. http://e2undel.sourceforge.net/ -- Andrew Gaffney -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Andrew Gaffney wrote: Matthew Baxa wrote: On Mon, 2003-11-24 at 17:11, Oliver Lange wrote: Phil Sexton wrote: Someone with more technical backround (less lazyness ;-P) would provide you with a more exaustive answer, but in short you cannot undelete files in a ReiserFS partition because of its very internal structure. Does this count? http://recover.sourceforge.net/unix/ Oh boy, that's a clear minus point for reiserfs.. Um, all the Unix filesystems (ext2, ext3, ReiserFS, XFS, JFS, UFS) have no undelete stuff. There was a program I used to use with ext2 before ext3 was big. I can't remember what it was called. You would add a 'LD_PRELINK' environment variable pointing at its dynamic lib that would override the unlink() function and move files into a protected environment. You could then run the associated utility to recover them. Also, it came with an *actual* ext2 undelete program that worked pretty well. I believe you're referring to libtrash, http://m-arriaga.net/software/libtrash/ . Not for me, but interesting idea. -Michael -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dude, you don't know what you're talking about, really. To delete a file = to mark a file "deleted". There are 2 cases: 1. just mark the file as deleted and then use the space whenever needed: - - pros: speed (you just have to write a few bytes to mark a file for deletion, on fat systems just 1 byte afaik), undeleting stuff (if you are telling me that you never needed an undelete program.. well..) - - cons: some other unwanted people might undelete stuff you don't want to have undeleted... 2. delete entire file (like overwriting the space occupied by the deleted data it with other garbage data) - - pros: fewer chance of undeletion (NOT null-chances, since with proper (expensive) equipment, somebody might still recover the data.. incredible isn't it ? that's why many programs let you choose how many times to overwrite the deleted portion ... (even hundreds of times) - - cons: SPEED !!! if the system would have to overwrite every file you delete, the writing speed would be half on deletion !! (example: to delete 1 700MB movie on my system would take 0.01 sec at most for case 1 and about 20-30 secs for case2) Linux and Windows and any system which cares about itself and its users should use the first variant by default, letting the users choose if they want that kind of security like file shredded by other programs.. At least on ext2 it is possible to undelete stuff, and maybe on the others too, but nobody really cared to design such programs... by the way, deleting a file will not put it in linux (by default at least) in "a hidden dir". The space which is marked as deleted can be used by the system at any time, and it appears as "free space" (not like windows recycle bin). If I didn't understand you correctly, please excuse me. On Wednesday 26 November 2003 04:33, Hemmann, Volker Armin wrote: > On Tuesday 25 November 2003 19:31, Oliver Lange wrote: > > Redeeman wrote: > > > its not a minus, its also a feature, sometimes if i delete data > > > i really want it to disappear! > > > > Well if i want to delete a file forever, there are many tools out > > there which do the job. For example, Krusader offers a "shred" > > command, other tools work from the console. These tools overwrite > > the whole file with Null-Bytes before deleting them. > > that is the same like buying a car.. and buying a second one for > left turns... > > If I delete a file, I want it to be gone. Nothing else. > > rm means remove not 'park this in a hidden dir' or 'obfuscate the > name'. > > That windows does not realy 'delete' but merely renames and > overwrites files, is only an additional sign for windos weak > design. Undeleting there is not a feature, but a way to exploit the > shortenings of fat. > > > -- > > [EMAIL PROTECTED] mailing list - -- -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/xBX9HMw8JJ+r9ucRAhhMAKClTGGz4sv4OpHKKqRWuO50pJIoFwCgncPs omhi4sFBmxpe74QaFWrxTp8= =WVnC -END PGP SIGNATURE- -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
ext2 at least _can_ undelete files. the problem is searching for the specific file to undelete. The quick way: start mc (midnight commander) and in one of the menus you will find Undelete: it will search for deleted files, but they have no names, only inode numbers.. if you know the approximate size of the file, you can sort by size and use F3 to see every file and try to guess the right one..I used that and it worked fine. On Tuesday 25 November 2003 01:28, Matthew Baxa wrote: > On Mon, 2003-11-24 at 17:11, Oliver Lange wrote: > > Phil Sexton wrote: > > >>Someone with more technical backround (less lazyness ;-P) would > > >> provide you with a more exaustive answer, but in short you > > >> cannot undelete files in a ReiserFS partition because of its > > >> very internal structure. > > > > > > Does this count? > > > http://recover.sourceforge.net/unix/ > > > > Oh boy, that's a clear minus point for reiserfs.. > > Um, all the Unix filesystems (ext2, ext3, ReiserFS, XFS, JFS, UFS) > have no undelete stuff. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Tuesday 25 November 2003 19:31, Oliver Lange wrote: > Redeeman wrote: > > its not a minus, its also a feature, sometimes if i delete data i really > > want it to disappear! > > Well if i want to delete a file forever, there are many tools out there > which do the job. For example, Krusader offers a "shred" command, other > tools work from the console. These tools overwrite the whole file with > Null-Bytes before deleting them. that is the same like buying a car.. and buying a second one for left turns... If I delete a file, I want it to be gone. Nothing else. rm means remove not 'park this in a hidden dir' or 'obfuscate the name'. That windows does not realy 'delete' but merely renames and overwrites files, is only an additional sign for windos weak design. Undeleting there is not a feature, but a way to exploit the shortenings of fat. > -- > [EMAIL PROTECTED] mailing list -- Conclusions In a straight-up fight, the Empire squashes the Federation like a bug. Even with its numerical advantage removed, the Empire would still squash the Federation like a bug. Accept it. -Michael Wong -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Tue, 25 Nov 2003 00:52:24 +0100 Norbert Kamenicky <[EMAIL PROTECTED]> wrote: > Juan Ángel wrote: > > > You could try to rewrite the "rm" program, or the code responsible > > > of deleting in the VFS to "fake" a removal. > > > :-) > > here u can find "safe rm replacement" > which worx in similar way as on windblowz ... > > http://www.cs.ecu.edu/~collins/rm/rm.html Also see: http://www.yoursitemaster.com/open_source/projects/trashcan/index.htm quote: Trash Can is a command line recycle bin for Linux/*NIX based systems. ksh, bash or zsh is needed to operate. Abilities Include: command description 1) rm or throw - file removal 2) trestore- file restoration (original path) 3) delete - permanent deletion of a single file from trash can 4) purge - automatic purging of trash over X number of days old 5) empty - completely empty trash can 6) tkeep - set number of days to keep trash 7) tmax- configure trash can storage capacity 8) prm - Permanent removal of files following this command 9) trash - displays Trash Can disk usage, trash commands, and unique files in trash sorted by name Other Abilities: - Trash is compressed to take up less room. - restore & delete both display a list of files to choose from. - Automatic permanent deletion of 'core' & 'dead.letter' files - Paging is enabled for long trash list. - Entire directories can be removed and restored/deleted. - Prompts user if restoring over and existing file, etc... - Warns you in varying degrees (soft & hard) as your trash can nears maximum storage capacity. - Install script is included for easy installation. It now has the ability to create users on the fly. - Notifies you of files about to be deleted. - Un-Install script is now included for ease of un-installation. It can now handle multiple users: uninstall for a single user, selected users, or all users. - Link deletion/restoration. blah blah blah. So I guess if you are in the habit of deleting things you shouldn't, or you provide support for "people" who do (*and who expect you to recover for them when they screw up), you might want to look at this. Me, I make it a habit to not delete stuff unless I need to. I'm just funny that way. haha Just as an aside, the first thing that gets done when I use windows is I remove the option to copy files to the trash can. When I delete something, I personally have a tendency to make sure that I am not going to need it before I do so and I want it gone. If I need to back it up or I am not sure, I mv the damn thing to a designated backup area. This saves time as my computer doesn't have to cp everything to the trash when I delete something. (yeah, I know I can hold the shift key down, but delete means delete, damn it, not "back it up in case I am a moron".) anyway, back to your regularly scheduled programming. -- / By protracting life, we do not deduct \ | one jot from the duration of death. -- | \ Titus Lucretius Carus / \ ^__^ \ (oo)\___ (__)\ )\/\ ||w | || || -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Oliver Lange <[EMAIL PROTECTED]> writes: > Redeeman wrote: >> its not a minus, its also a feature, sometimes if i delete data i >> really >> want it to disappear! >> > > Well if i want to delete a file forever, there are many tools out there > which do the job. For example, Krusader offers a "shred" command, other > tools work from the console. These tools overwrite the whole file with > Null-Bytes before deleting them. It's still not deleted. If a sufficiently determinded party wants to recover your data, they can do it. -- Hilsen Harald. -- [EMAIL PROTECTED] mailing list
RE: [gentoo-user] reiserfs undelete ?
Unix is a "what you say is what you get" sort of operating system. It is not very forgiving, but I like it that way. It sucks when you type "rm -r *" in the root directory by accident. I did type it once and learned a very valuable lesson (don't do that). If you are often deleting files by accident, you should look into a solution that moves the files to a temporary folder to be deleted later. I can see this happening if your used to windows or macos, because you can always restore. I think gnome does this on the desktop by default. -Nathan >-Original Message- >From: Oliver Lange > >Redeeman wrote: >> >> its not a minus, its also a feature, sometimes if i delete data i really >> want it to disappear! > >Well if i want to delete a file forever, there are many tools out there >which do the job. For example, Krusader offers a "shred" command, other >tools work from the console. These tools overwrite the whole file with >Null-Bytes before deleting them. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Redeeman wrote: its not a minus, its also a feature, sometimes if i delete data i really want it to disappear! Well if i want to delete a file forever, there are many tools out there which do the job. For example, Krusader offers a "shred" command, other tools work from the console. These tools overwrite the whole file with Null-Bytes before deleting them. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Anders Hasselqvist wrote: Unmount the drive a.s.a.p after you deleted the file Absolutely clear. Make a backup of the partition run reiserfsck --rebuild-tree --scan-whole-partition remount. Copy the deleted file to another partition Re-"install" the backup Something like that. Well better than no way. It's an enourmous procedure, especially if one has huge amounts of data on a modern (big) harddisk, but in fact i rarely need such recovery operations (once in a few years), so this is at least a way. Thank you. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
> There was a program I used to use with ext2 before ext3 was big. I can't debugfs, it will try to undelete the file if possible. but as always, it's important to unmount the partition asap after the deletion. -- Sigurd Stordal master in Petrology/mineralogy President of GOGS Opuscreator VS in DNM95 -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Tue, 2003-11-25 at 00:11, Oliver Lange wrote: > Phil Sexton wrote: > >>Someone with more technical backround (less lazyness ;-P) would provide > >>you with a more exaustive answer, but in short you cannot undelete files > >>in a ReiserFS partition because of its very internal structure. > >> > > > > Does this count? > > http://recover.sourceforge.net/unix/ > > > > Oh boy, that's a clear minus point for reiserfs.. > its not a minus, its also a feature, sometimes if i delete data i really want it to disappear! > Thanks to both of you for your help. > > > -- > [EMAIL PROTECTED] mailing list -- Regards, Redeeman () ascii ribbon campaign - against html e-mail /\- against microsoft attachments -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Mon, 24 Nov 2003, Noberasco Michele wrote: > > Hi everyone, > Hello Oliver > > > Is there any reiserfs undelete command/application > > out there, for the case of accidently deleted file(s) ? > Nope. > > Someone with more technical backround (less lazyness ;-P) would provide > you with a more exaustive answer, but in short you cannot undelete files > in a ReiserFS partition because of its very internal structure. > > Correct me if I'm wrong... > > Bye, > Michele Noberasco > Hi, Well, I did undelete some files I accidently lost on a ReiserFS partition. It is a bit tricky and I can't remember exactly how I did it. Here goes: Unmount the drive a.s.a.p after you deleted the file Make a backup of the partition run reiserfsck --rebuild-tree --scan-whole-partition remount. Copy the deleted file to another partition Re-"install" the backup Something like that. There is a mail about this in the reiserfs mail archives. I don't remember the author so you have to search manually. Regards, -- Anders Hasselqvist [EMAIL PROTECTED] http://good-deed.dhs.org/ -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Monday 24 November 2003 16:28, Andrew Gaffney wrote: > Matthew Baxa wrote: > > On Mon, 2003-11-24 at 17:11, Oliver Lange wrote: > >>Phil Sexton wrote: > Someone with more technical backround (less lazyness ;-P) would provide > you with a more exaustive answer, but in short you cannot undelete > files in a ReiserFS partition because of its very internal structure. > >>> > >>>Does this count? > >>>http://recover.sourceforge.net/unix/ > >> > >>Oh boy, that's a clear minus point for reiserfs.. > > > > Um, all the Unix filesystems (ext2, ext3, ReiserFS, XFS, JFS, UFS) have > > no undelete stuff. > > There was a program I used to use with ext2 before ext3 was big. I can't > remember what it was called. You would add a 'LD_PRELINK' environment > variable pointing at its dynamic lib that would override the unlink() > function and move files into a protected environment. You could then run > the associated utility to recover them. Also, it came with an *actual* ext2 > undelete program that worked pretty well. I remember something like this too except the one I'm thinking of was simply a script that would move the deleted data into a "recycle bin". If you wanted to recover a file you would simply pull it from this bin. The only downside is that there was some manual maintanence as the script didn't purge deleted files--the author suggested setting up a cron job for this. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Juan Ángel wrote: You could try to rewrite the "rm" program, or the code responsible of deleting in the VFS to "fake" a removal. :-) here u can find "safe rm replacement" which worx in similar way as on windblowz ... http://www.cs.ecu.edu/~collins/rm/rm.html -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Matthew Baxa wrote: On Mon, 2003-11-24 at 17:11, Oliver Lange wrote: Phil Sexton wrote: Someone with more technical backround (less lazyness ;-P) would provide you with a more exaustive answer, but in short you cannot undelete files in a ReiserFS partition because of its very internal structure. Does this count? http://recover.sourceforge.net/unix/ Oh boy, that's a clear minus point for reiserfs.. Um, all the Unix filesystems (ext2, ext3, ReiserFS, XFS, JFS, UFS) have no undelete stuff. There was a program I used to use with ext2 before ext3 was big. I can't remember what it was called. You would add a 'LD_PRELINK' environment variable pointing at its dynamic lib that would override the unlink() function and move files into a protected environment. You could then run the associated utility to recover them. Also, it came with an *actual* ext2 undelete program that worked pretty well. -- Andrew Gaffney -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Mon, 2003-11-24 at 17:11, Oliver Lange wrote: > Phil Sexton wrote: > >>Someone with more technical backround (less lazyness ;-P) would provide > >>you with a more exaustive answer, but in short you cannot undelete files > >>in a ReiserFS partition because of its very internal structure. > >> > > > > Does this count? > > http://recover.sourceforge.net/unix/ > > > > Oh boy, that's a clear minus point for reiserfs.. Um, all the Unix filesystems (ext2, ext3, ReiserFS, XFS, JFS, UFS) have no undelete stuff. -- Matthew Baxa <[EMAIL PROTECTED]> Applications Services Assistant K-State University Office of Mediated Education http://www.dce.ksu.edu signature.asc Description: This is a digitally signed message part
Re: [gentoo-user] reiserfs undelete ?
Phil Sexton wrote: Someone with more technical backround (less lazyness ;-P) would provide you with a more exaustive answer, but in short you cannot undelete files in a ReiserFS partition because of its very internal structure. Does this count? http://recover.sourceforge.net/unix/ Oh boy, that's a clear minus point for reiserfs.. Thanks to both of you for your help. -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
Hi, > Hi everyone, > > Is there any reiserfs undelete command/application > out there, for the case of accidently deleted file(s) ? > > I rarely need an undelete command (once in some years), > but i always had a nice GUI tool for undeleting files > from NTFS partitions under Windows (copying the file(s) > to another partition, not changing anything). > > I can't believe that such an important thing should not > be possible with reiserfs while every MS-FileSys supports it... Well, actually the issue of undeleting files under a multi process systeme is quite a easy thing to solve: it is impossible to assure that the deleted file will be kept on disk until you try to recover it. Since any other process can write right after you delete your file, there is no "sure way" to recover them. You could try, though, to find where it stayed, and, if your file is not too big to be split into several non contiguous blocks, try to recover it by reading right from the partition (as Phil Sexton pointed out). With a bigger file, it is probably that your data is spread out all around your hard drive (actually, not all around, but kind of). Well, that's just my opinion. It's been "a while" since I studied OS, so I may be wrong. I apologize in case of that. The way "OS" like windows fake this "file recover" is by moving the files into an other destination, not by recovering them (at least in the multi process windows -the new ones-; it was not so in the past). You could try to rewrite the "rm" program, or the code responsible of deleting in the VFS to "fake" a removal. Good luck with your investigation!! -- Juan Ángel PGP key on pgp.rediris.es (8FAF18B7) or search on http://www.rediris.es/cert/servicios/keyserver/ pgp0.pgp Description: signature
Re: [gentoo-user] reiserfs undelete ?
On Mon, 2003-11-24 at 17:15, Noberasco Michele wrote: > > Is there any reiserfs undelete command/application > > out there, for the case of accidently deleted file(s) ? > Nope. > > > I can't believe that such an important thing should not > > be possible with reiserfs while every MS-FileSys supports it... > Someone with more technical backround (less lazyness ;-P) would provide > you with a more exaustive answer, but in short you cannot undelete files > in a ReiserFS partition because of its very internal structure. > > Correct me if I'm wrong... Does this count? http://recover.sourceforge.net/unix/ -- Phil Our 2nd CD: http://www.cdbaby.com/naomisfancy Naomi's Fancy performances: http://naomisfancy.virtualave.net/schedule.html -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] reiserfs undelete ?
On Mon, 24 Nov 2003 17:44:58 +0100 Oliver Lange <[EMAIL PROTECTED]> wrote: > Hi everyone, Hello Oliver > Is there any reiserfs undelete command/application > out there, for the case of accidently deleted file(s) ? Nope. > I can't believe that such an important thing should not > be possible with reiserfs while every MS-FileSys supports it... Someone with more technical backround (less lazyness ;-P) would provide you with a more exaustive answer, but in short you cannot undelete files in a ReiserFS partition because of its very internal structure. Correct me if I'm wrong... Bye, Michele Noberasco -- Linux *IS* user friendly: it just appears to be selective who it is friend with! pgp0.pgp Description: PGP signature
[gentoo-user] reiserfs undelete ?
Hi everyone, Is there any reiserfs undelete command/application out there, for the case of accidently deleted file(s) ? I rarely need an undelete command (once in some years), but i always had a nice GUI tool for undeleting files from NTFS partitions under Windows (copying the file(s) to another partition, not changing anything). I can't believe that such an important thing should not be possible with reiserfs while every MS-FileSys supports it... -- [EMAIL PROTECTED] mailing list
