How does iOS delete a file technically and can it potentially be undeleted?
We have an interesting discussion here about file deletion on iOS devices.
The question was: if I delete a file using NSFileManager, what's happening
under the hood?
My understanding is that deletion is performed by removing the
corresponding file entry from the file system table.
The counter argument is that a file handle remains in some way and only a
flag gets set which marks the file as deleted. If the user had root access
to the iOS device, he could potentially reset that flag and recover the
file content.
In both cases we agree that the actual file content will not be
overwritten and the plain bytes still exist on the flash memory/disk until
the block is occupied by another file.
The idea is now: if the second version is true, we could overwrite the
file with a one byte content prior to deletion (even if that byte gets
written to a new location on the flash drive without actually overwriting
the old content). If then the file is recovered, only the overwritten one
byte content is available.
Note that we're not talking about forensic analysis of the flash drive
which could maybe recover the original file content.
So to recap:
How does deletion of a file on iOS work internally?
Does the overwrite approach prevent undeletion?
No comments:
Post a Comment