How does "rm" on a NTFS filesystem differs from Window's own implementation?
        Posted  
        
            by 
                DavideRossi
            
        on Ask Ubuntu
        
        See other posts from Ask Ubuntu
        
            or by DavideRossi
        
        
        
        Published on 2011-11-13T15:14:30Z
        Indexed on 
            2011/11/13
            18:06 UTC
        
        
        Read the original article
        Hit count: 338
        
I have an external USB disk with an NTFS filesystem on it.
If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").
If I remove the file from Linux no utility (unless I use a deep-search signature-based one) can recover the file. Why? How is unlink implemented in Linux's NTFS file system code? It looks like it does not just "mark it as undeleted" but it wipes away some on-disk structure, is this the case?
© Ask Ubuntu or respective owner