How to delete deleted files in linux

How to permanently delete already deleted files in Linux?

How do I prevent the recovery of already deleted files in Linux (without drastic measures (i.e. reset))?

What filesystem? What «file recovery» tools does the interested party have? How valuable is the contents to them?

destroy the hard drive by shredding it . as long as the drive is usable, data recovery in part, or in full is possible

2 Answers 2

Generally, the shred or wipe commands should do the trick.

e.g. this secure deletes everything under doc.

Ofcourse disc dumping should be good too -> $ dd

If the file was already deleted, then you have to wipe the free space.

If you’re ok doing a single-pass wipe, the quickest way would be:

cat /dev/zero > zero.file sync rm zero.file 

Refer to original answer on super user: https://superuser.com/a/19488/9231

You must log in to answer this question.

Related

Hot Network Questions

Subscribe to RSS

To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

Site design / logo © 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA . rev 2023.7.17.43536

Linux is a registered trademark of Linus Torvalds. UNIX is a registered trademark of The Open Group.
This site is not affiliated with Linus Torvalds or The Open Group in any way.

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

Источник

How to remove files and directories quickly via terminal (bash shell) [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.

From a terminal window: When I use the rm command it can only remove files.
When I use the rmdir command it only removes empty folders. If I have a directory nested with files and folders within folders with files and so on, is there a way to delete all the files and folders without all the strenuous command typing? If it makes a difference, I am using the Mac Bash shell from a terminal, not Microsoft DOS or Linux.

Just in case you wish to restore the files in future , don’t use «rm» for such cases . Use «rm-trash» : github.com/nateshmbhat/rm-trash

4 Answers 4

-r «recursive» -f «force» (suppress confirmation messages)

+1 and glad you added the «Be careful!» part. definitely a «Sawzall» command that can quickly turn a good day into a bad one.. if wielded carelessly.

@itsmatt: You know what they say. give someone a Sawzall, and suddenly every problem looks like hours of fun!

On a Mac? Do this instead: brew install trash then trash -rf some_dir This will move the unwanted directory into your trashbin instead of just vanishing Prestige-style into the ether. (source)

Would remove everything (folders & files) in the current directory.

But be careful! Only execute this command if you are absolutely sure, that you are in the right directory.

Yes, there is. The -r option tells rm to be recursive, and remove the entire file hierarchy rooted at its arguments; in other words, if given a directory, it will remove all of its contents and then perform what is effectively an rmdir .

The other two options you should know are -i and -f . -i stands for interactive; it makes rm prompt you before deleting each and every file. -f stands for force; it goes ahead and deletes everything without asking. -i is safer, but -f is faster; only use it if you’re absolutely sure you’re deleting the right thing. You can specify these with -r or not; it’s an independent setting.

And as usual, you can combine switches: rm -r -i is just rm -ri , and rm -r -f is rm -rf .

Also note that what you’re learning applies to bash on every Unix OS: OS X, Linux, FreeBSD, etc. In fact, rm ‘s syntax is the same in pretty much every shell on every Unix OS. OS X, under the hood, is really a BSD Unix system.

Источник

Find and remove large files that are open but have been deleted

How does one find large files that have been deleted but are still open in an application? How can one remove such a file, even though a process has it open? The situation is that we are running a process that is filling up a log file at a terrific rate. I know the reason, and I can fix it. Until then, I would like to rm or empty the log file without shutting down the process. Simply doing rm output.log removes only references to the file, but it continues to occupy space on disk until the process is terminated. Worse: after rm ing I now have no way to find where the file is or how big it is! Is there any way to find the file, and possibly empty it, even though it is still open in another process? I specifically refer to Linux-based operating systems such as Debian or RHEL.

If you know the pid then you can use lsof -p to list its open files and their sizes. The deleted file will have a (deleted) next to it. The deleted file will be linked at /proc//fd/1 probably. I don’t know how to make a process stop writing to its file descriptor without terminating it. I would think that would depend on the process.

@donothingsuccessfully The «deleted» tag reported by lsof is Solaris specific, in fact Solaris 10 or later only. The OP did not specify what operating system he is using. @dotancohen On Solaris you can pipe the output of lsof to search for deleted, eg lsof | grep «(deleted)» . When there are no more processes holding a deleted file open, the kernel will free up the inode and disk blocks. Processes do not have «handlers» by which they can be notified that an open, essentially locked file, have been removed from disk.

@Johan, the lsof | grep ‘(deleted)’ works on Linux as well. On Linux, you can be notified of file deletion (even files that already don’t have any entry in any directory other than /proc/some-pid/fd anymore) with the inotify mechanism (IN_DELETE_SELF event)

I created somefile and opened it in VIM, then rm ed it in another bash process. I then run lsof | grep somefile and it is not in there, even though the file is open in VIM.

4 Answers 4

If you can’t kill your application, you can truncate instead of deleting the log file to reclaim the space. If the file was not open in append mode (with O_APPEND ), then the file will appear as big as before the next time the application writes to it (though with the leading part sparse and looking as if it contained NUL bytes), but the space will have been reclaimed (that does not apply to HFS+ file systems on Apple OS/X that don’t support sparse files though).

If it was already deleted, on Linux, you can still truncate it by doing:

Where $pid is the process id of the process that has the file opened, and $fd one file descriptor it has it opened under (which you can check with lsof -p «$pid» .

If you don’t know the pid, and are looking for deleted files, you can do:

lsof -nP +L1 , as mentioned by @user75021 is an even better (more reliable and more portable) option (list files that have fewer than 1 link).

find /proc/*/fd -ls | grep '(deleted)' 

Or to find the large ones with zsh :

An alternative, if the application is dynamically linked is to attach a debugger to it and make it call close(fd) followed by a new open(«the-file», . ) .

@OlivierDulac, lsof is probably going to be the closest to a portable solution you can get to list open files. the debugger approach to close the fd under the application feet should be quite portable as well.

@StephaneChazelas: thanks. I found a way to list all PIDs which have a file open on each partitions : df -k | awk ‘NR>1 < print $NF >‘ | xargs fuser -Vud (and then easy to send signals to the offenders to force them to release the fd)

You can also use lsof +L1 . From the lsof man page: «A specification of the form +L1 will select open files that have been unlinked. A specification of the form +aL1 will select unlinked open files on the specified file system.». That should be a bit more reliable than grepping.

Check out the quickstart here: lsof Quickstart

I’m surprised no one mentioned the lsof quickstart file (included with lsof). Section «3.a» shows how to find open, unlinked files:

[root@enterprise ~]# lsof -a +L1 /tmp COMMAND PID USER FD TYPE DEVICE SIZE NLINK NODE NAME httpd 2357 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) mysqld 2588 mysql 4u REG 253,17 52 0 1495 /tmp/ibY0cXCd (deleted) mysqld 2588 mysql 5u REG 253,17 1048 0 1496 /tmp/ibOrELhG (deleted) mysqld 2588 mysql 6u REG 253,17 0 0 1497 /tmp/ibmDFAW8 (deleted) mysqld 2588 mysql 7u REG 253,17 0 0 11387 /tmp/ib2CSACB (deleted) mysqld 2588 mysql 11u REG 253,17 0 0 11388 /tmp/ibQpoZ94 (deleted) httpd 3457 root 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 8437 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 8438 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 8439 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 8440 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 8441 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 8442 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 8443 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 8444 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 16990 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 19595 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 27495 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 28142 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) httpd 31478 apache 29u REG 253,17 3926560 0 1499 /tmp/.NSPR-AFM-3457-9820130.0 (deleted) 

On Red Hat systems to find the local copy of the quick-start file, I usually do this:

[root@enterprise ~]# locate -i quickstart |grep lsof /usr/share/doc/lsof-4.78/00QUICKSTART 

[root@enterprise ~]# rpm -qd lsof /usr/share/doc/lsof-4.78/00.README.FIRST /usr/share/doc/lsof-4.78/00CREDITS /usr/share/doc/lsof-4.78/00DCACHE /usr/share/doc/lsof-4.78/00DIALECTS /usr/share/doc/lsof-4.78/00DIST /usr/share/doc/lsof-4.78/00FAQ /usr/share/doc/lsof-4.78/00LSOF-L /usr/share/doc/lsof-4.78/00MANIFEST /usr/share/doc/lsof-4.78/00PORTING /usr/share/doc/lsof-4.78/00QUICKSTART /usr/share/doc/lsof-4.78/00README /usr/share/doc/lsof-4.78/00TEST /usr/share/doc/lsof-4.78/00XCONFIG /usr/share/man/man8/lsof.8.gz 

Источник