Re: ext2 not NULLing deleted files?

[Andi Kleen]

Enver Haase <[e-mail]> writes:

> Hi there,
> 
> I just recognized there's an "undelete" now for ext2 file systems [a KDE 
> app].

There have been ext2 undeletes for many years now (and howtos how to do
it manually even longer), nothing new.

> 
> "The Other OS" in its professional version does of course clear the deleted 
> blocks with 0's for security reasons; I would have bet a thousand bucks Linux 
> would do so, too [seems I should have read the source code, good thing no-one 
> wanted to take on the bet :) ].
> 
> So how to go about this? With that feature wanted, which fs should one choose 
> under Linux? Is there a patch for ext2 for that feature? Am I the only one 
> liking the idea?

Old ext2 (before 2.0) supported this with a special attribute bit; but it was 
removed for good reasons.
Just NULLing alone is quite useless anyways; just 0ed data can be easily
recovered in a special laboratory by using old traces of magnetism on the
surfaces.
If you care about real data deletion you should probably use an utility
like wipe which does about 20-30 passes with random data. That is far too
complex to do in kernel space of course, but you can run it in user space
as needed. 0ing would just give you a false sense of security.

-Andi