Partially true. The difference is that in Linux, when you delete a file, you’re just removing the directory entry (potentially just one of many entries that point to the same data). The filesystem doesn’t actually remove the data and reclaim space until all open handles are closed and no remaining directory entries point to the data.
Any running processes that have the file open are able to continue to read and write that data via the handle despite the directory entry being removed, until the handle is closed.
I think a file delete just removing an adress and not the actual data is common to all OSes. That’s why to safely erase data from a disk it is recommended to fully overwrite the disk with random data, potentially multiple times.
that’s a different thing. if you delete a file that is still opened by a process, the space will not get freed up until that process also closed the file. until that point the filesystem still keeps track of the file, it is just not present in any directories anymore.
If you delete a still opened file on Linux then the file will disappear for all processes which didn’t already open it, all programs that did already open it can still read and write to it and the file on disk will never be overwritten (as in, used for other files) as long as there’s still a process with the file open.
Simplifying how it works:
The file you see is a link to the actual file(inode), when a program opens a file using this link they get a copy of the link. As long as one link/copy of it still exist the file won’t be deleted. When a program closes all its links get cleaned up so on shutdown all files which only have processes referring to them get marked as deleted.
This but deleting a folder:
Meanwhile on Linux with sudo rm -rf, it’s just gone as demanded.
Partially true. The difference is that in Linux, when you delete a file, you’re just removing the directory entry (potentially just one of many entries that point to the same data). The filesystem doesn’t actually remove the data and reclaim space until all open handles are closed and no remaining directory entries point to the data.
Any running processes that have the file open are able to continue to read and write that data via the handle despite the directory entry being removed, until the handle is closed.
I think a file delete just removing an adress and not the actual data is common to all OSes. That’s why to safely erase data from a disk it is recommended to fully overwrite the disk with random data, potentially multiple times.
that’s a different thing. if you delete a file that is still opened by a process, the space will not get freed up until that process also closed the file. until that point the filesystem still keeps track of the file, it is just not present in any directories anymore.
If you delete a still opened file on Linux then the file will disappear for all processes which didn’t already open it, all programs that did already open it can still read and write to it and the file on disk will never be overwritten (as in, used for other files) as long as there’s still a process with the file open.
Simplifying how it works: The file you see is a link to the actual file(inode), when a program opens a file using this link they get a copy of the link. As long as one link/copy of it still exist the file won’t be deleted. When a program closes all its links get cleaned up so on shutdown all files which only have processes referring to them get marked as deleted.
I mean you could probably delete files with powershell then idk.