3

I have an external USB disk with an NTFS filesystem on it.

If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").

If I remove the file from Linux (I'm using Ubuntu) no utility can recover the file (unless I use a deep-search signature-based one). Why? It looks like Linux does not just "mark it as deleted" but it wipes away some on-disk structure, is this the case?

DavideRossi
  • 31
  • 1
  • Reposted [here](http://unix.stackexchange.com/questions/27148/how-does-rm-on-a-ntfs-filesystem-differs-from-windows-own-implementation) – Michael Mrozek Dec 19 '11 at 11:18

1 Answers1

1

Linux's NTFS implementation (NTFS-3G) only supports partial journaling -- only enough to handle an unclean shutdown. It's not enough to track file history.

David Schwartz
  • 31,215
  • 2
  • 53
  • 82