Undelete on Mac and Linux filesystems
It is difficult if not impossible to undelete a file on Apple Mac (HFS/HFS+, and UFS filesystems) and Linux (ext3 and ext4 filesystems).
When a file is deleted, the data about the file location is deleted irreversibly due to some reasons inherent to each of
the above mentioned filesystems.
You have only one way to try to undelete a file - raw recovery (search a hard disk for the file headers), but it is not reliable.
Raw recovery is limited to unfragmented files; another disadvantage of raw recovery is that folder structure and file names are not recovered at all.
Note that for HFS and HFS+ filesystems it is recommended to actually try to recover data because it is difficult
to predict the result of data recovery a priori.
Sometimes deletion makes irreversible changes to the filesystem, sometimes not.
This is due to the filesystem design.
|