Recovering file after cat /dev/null > [foo]

[Davey]

After hearing all the jokes and puns about /dev/null, I got kinda curious, so on a separate partition of my hard drive, I went:

$ echo testing_123456789 > testfile
$ cat testfile

which returned:
testing_123456789

Then I overwrote it:
$ cat /dev/null > testfile
$ cat testfile

"testfile" comes up empty, as I expected after writing null to it, but I've been wondering if it's possible to retrieve the contents of testfile, just for future reference (or in case I run into other such disasters...). What do you think, is it really gone for good, as in, "not even expensive clean-room hard drive rescue service can get this back now, oh noes we's doomed," or can the contents of the file still be retrieved if nothing has been written to that partition?

[Pu-239]

IIRC correctly, the above commands would leave the file mostly intact on the hard drive, retrievable with a disk editor. I believe "cat /dev/zero > testfile" (and waiting long enough for it to actually overwrite the file) would be more effective at removal of data if that's your goal, but it's no guarantee due to journalling and stuff which may leave stuff behind.

[Pu-239]

There are some libraries that are LD_PRELOADed to approximate a trashcan by intercepting deletes and putting them in a special trash folder, however they have their own problems.


An alternative is to wrap the "rm" command w/ a shell script or something. Not recommended as it trains bad habits that might be catastrophic if one is moved to another machine.

Neither prevent you from accidentally overwritting something, but that's a problem on every OS. Deletion as well, afaik deletion using "delete" on Windows doesn't move things into recycle either; that's a function of Windows Explorer. PEBKAC is a problem on every OS, not just *nix.