You seem to have missed completely that the files does not exist anymore.
You must do a secure erase of the whole SSD. Read:
https://wiki.archlinux.org/title/Solid_state_drive/Memory_cell_clearing
for instructions how to wipe a SSD with “hdparm --security-erase”.
Does it guess the range of location of that deleted file? A big range or smaller?
Yes, it does.
filefrag -b512 -v .bash_history will get the start and end block of /root/.bash_history, is this enough to undelete it if it get deleted.
Sorry, I completely lost you. You start with telling that you deleted a file and then you ask about a file that is not deleted.
The file has been deleted, but not shreded, if I remember the start and end block of it, can I get it back?
#filefrag -b512 -v '/home/endar/TFOO'
Filesystem type is: 9123683e
File size of /home/endar/TFOO is 646 (8 block of 512 bytes)
ext: logical_offset: physical_offset: length: expected: flags:
0: 0.. 4095: 0.. 4095: 4096: last,not_aligned,inline,eof
#rm '/home/endar/TFOO'
Once TFOO is deleted, can it be undeleted by the information above?
Files can be fragmented over the file system.
Why can you not accept facts?
The sequence is:
- shred the file;
- delete the file.
When you did not do step #1, you are too late now. And as long as time traveling is not invented, you can no redo it in the correct sequence.
I"m confused. In early January, it was suggested by 2-3 folks what the possible solutions are. The whole point of this post is, “I deleted a file, but worried about its content being left on disk”.
So, once AGAIN, you can get a huge binary file and write to the USB thumb drive. Or better yet, copy multiple binary files … doing so will overwrite the portions of the disk that the “sensitive” file occupied.
Another suggestion (a better solution) was: make a backup of the USB thumb drive, then re-format the USB thumb drive, then restore from the backup.
But the OP’s response was, “it will take too long (supposedly hours) to do either option”.
Guess what … it’s now the middle of February, so it’s now been over 30 days - the solution could have been completed over a month ago.
That’s why I’m confused.
No, it cannot. This information does not even show the physical location of this file.
1 Like
Which application shows the physical location of this file?
So, once AGAIN, you can get a huge binary file and write to the USB thumb drive. Or better yet, copy multiple binary files … doing so will overwrite the portions of the disk that the “sensitive” file occupied.
Simply wrong. A USB thumb drive has a memory controller. EXT2, EXT3, EXT4, XFS, FAT16, FAT32, exFAT, BTRFS and NTFS are popular file systems for storage devices equipped with a memory controller.
A memory controller works with garbage collector (GC), spare area (over provisioning) and other tricks.
You must send special erase commands (secure erase) to the memory controller for (secure) erase of the whole spare area!
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.