How does "rm" on a NTFS filesystem differs from Window's own implementation?
- by DavideRossi
I have an external USB disk with an NTFS filesystem on it.
If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").
If I remove the file from Linux no utility (unless I use a deep-search signature-based one) can recover the file. Why? How is unlink implemented in Linux's NTFS file system code? It looks like it does not just "mark it as undeleted" but it wipes away some on-disk structure, is this the case?
