8
From an article on file recovery I read, that when a file is deleted on your computer, only a pointer to the file is deleted and the space occupied by the file is marked as free to use. Is the only reason for this to recover "deleted" files or are there any other reasons why the space occupied isn't actually deleted (bits set to zero)?
John Nevermore
Posted 2012-11-08T11:56:20.267
Reputation: 209
20
The reason to prefer unlinking instead of zeroing a file is performance. It's far easier to simply zero a variable in the filesystem data structre rather than start overwriting an entire file. In modern filesystems unlinking the file takes a constant amount of time regardless of file size, whereas the time spent overwriting a file is proportional to file size.
zxcdw
Posted 2012-11-08T11:56:20.267
Reputation: 316
"Unlinking the file takes a constant amount of time regardless of file size" - whether that is true depends on the data structures used to manage free space. Many older filesystems use a block bitmap, where freeing space takes time proportional to the file size. – Michael Borgwardt – 2012-11-08T12:21:03.927
@MichaelBorgwardt Thanks, modified the answer for clarity. – None – 2012-11-08T12:36:54.597
Couldn't have said it better. – octopusgrabbus – 2012-11-08T18:12:33.813
8
Because it would take much more time, and is not necessary unless you want to make the recovery of deleted files impossible, which is rarely the case.
Michael Borgwardt
Posted 2012-11-08T11:56:20.267
Reputation: 3 047
2+1 for "much more time". The file system wasn't designed with zeroing out data as a requirement, but it was designed to be as fast as possible. – Scott Whitlock – 2012-11-08T12:06:25.777
Consider erasing the blocks used by a file on slow media. FAT was initially designed for floppy disks, and even floppies became faster as technology progressed. The ability to recover deleted files is largely a side effect of the decision to not overwrite the data, not the other way around. More modern file systems (particularly those with copy-on-write technology: btrfs, zfs, ...) have other considerations (by the time you delete the file, you might not even have a record of where each copy has been stored historically, and you certainly don't want to double every write if you don't have to). – a CVn – 2012-11-08T13:35:16.177