Ubuntu – Can you recover previous versions of files

data-recoverydeleteeditingfiles

I know that if I delete a file it won't actually be 'deleted' as such, just marked as 'can be overridden when needed' so that when that space is needed the file will just be overridden, and this means that after a file is deleted it is possible to recover it even though all links to it will be gone (if any of this information is incorrect please edit this question to explain it in the correct way).
But is the same true for files which have just been edited? Can one recover the previous version of a file if the previous version hasn't been made into a .save file or something? That is, if I edit a file and then save my changes, is there any way to recover the previous version of the file like one can do with deleted files? And if not, if one does not want anyone to be able to properly recover deleted files, should one first edit the file and replace the contents with something else?

So just to clarify, these are the points I want answered:

  • Is it possible to recover the previous versions of files if no backup file has been created (such as a .save file) like one can do with actually deleted files?

  • Is editing a file before deleting it safer than just deleting it (that is is it safer to overwrite the entire contents of a file with other contents before deleting it)?

  • Finally, do tools which 'shred' files such as BleachBit just overwrite the contents of a file with other contents (such as an encrypted version of the file where the private key is deleted) before deleting it or do they use another method?

But please note that I am not asking about how to log file changes, I am asking this question because I want to know if editing a file before deleting it is safer than just deleting it or whether previous versions can be recovered. I am not interested in answers telling me that I should use version control systems to monitor file changes.

Best Answer

Yes, it is possible to recover an overwritten file, but recovery depends on the file system and the application you're using. FAT, EXT2/3/4, NTFS all delete files by marking them deleted. (no experience with other file systems)

What all well-written applications normally do nowadays is to open a temporary file, and if that is written correctly, delete the old file and rename the temp file to the new file. That way is a program crashes while it's writing the new file, it doesn't destroy the old file. (E.G. That's how LibreOffice overwrites its files)

Secure wipe applications normally overwrite the file, but under EXT4 and NTFS defragmentation intelligence and journalling kick in so to be absolutely, positively sure that an overwritten file is completely gone, you need to overwrite the entire free space too.

(Even on an encrypted volume)

Related Question