Hacker News new | ask | show | jobs
by noja 3684 days ago
When using the terminal command rm (or DEL on Windows), files are not actually removed.

Yes they are. As a user, I see a file, type rm file, then it is gone. The file has been removed.

Yes those parts of that file are possibly recoverable back into the original file, even without much work, but the file has been removed.

1 comments

The file, yes, but not the file contents. Worst of all, if you opened the file recently with any process, there is a pretty good chance that the file-descriptor can be found in:

  /proc/
somewhere.

And with that in mind you can use a combination of lsof, grep, sed or any other tool to still read the file as it was.

You are correct that the file contents may remain in memory.

Neither this tool nor GNU shred nor BSD `rm -P` can do anything about it.