3

I have an external USB disk with an NTFS filesystem on it.

If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").

If I remove the file from Linux (I'm using Ubuntu) no utility can recover the file (unless I use a deep-search signature-based one). Why? It looks like Linux does not just "mark it as deleted" but it wipes away some on-disk structure, is this the case?

DavideRossi
  • 31

1 Answers1

1

Linux's NTFS implementation (NTFS-3G) only supports partial journaling -- only enough to handle an unclean shutdown. It's not enough to track file history.

David Schwartz
  • 31,893