Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an external USB disk with an NTFS filesystem on it.

If I remove a file from Windows and I run one of the several "undelete" utilities (say, TestDisk) I can easily recover the file (because "it's still there but it's marked as deleted").

If I remove the file from Linux (I'm using Ubuntu) no utility can recover the file (unless I use a deep-search signature-based one). Why? It looks like Linux does not just "mark it as deleted" but it wipes away some on-disk structure, is this the case?

share|improve this question

closed as off topic by sysadmin1138 Nov 17 '11 at 20:39

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Reposted here –  Michael Mrozek Dec 19 '11 at 11:18

1 Answer 1

Linux's NTFS implementation (NTFS-3G) only supports partial journaling -- only enough to handle an unclean shutdown. It's not enough to track file history.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.