up vote 3 down vote favorite
share [g+] share [fb]

I have an external USB disk with an NTFS filesystem on it.

If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").

If I remove the file from Linux (I'm using Ubuntu) no utility can recover the file (unless I use a deep-search signature-based one). Why? It looks like Linux does not just "mark it as deleted" but it wipes away some on-disk structure, is this the case?

link|improve this question
Reposted here – Michael Mrozek Dec 19 '11 at 11:18
feedback

closed as off topic by sysadmin1138♦ Nov 17 '11 at 20:39

Questions on Server Fault are expected to generally relate to servers, networking, or desktop infrastructure, within the scope defined in the faq.

1 Answer

up vote 1 down vote

Linux's NTFS implementation (NTFS-3G) only supports partial journaling -- only enough to handle an unclean shutdown. It's not enough to track file history.

link|improve this answer
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.