Hacker News Reader

Also, wouldn't it be possible to recover the files on most filesystems, assuming the disk is too not full?

The program has to encrypt them, unlink the files, and save the encrypted files / archive. If the filesystem needs more space later, it writes over those (discarded) files, right? Everything else would increase disk wear and decrease performance.

Edit: of course excluding SSDs with TRIM/discard enabled.

View on HN

The problem is that "needs more space later" can occur as soon as the malware moves on to the next file to encrypt.

Also, overwriting discarded files can happen even before the filesystem runs out of space; it depends on the allocation strategy. To maximally preserve the possibility of undeleting files, there would have to be a policy of using the least recently freed blocks for new allocation. That could be pessimistic in other regards, like minimizing fragmentation and seek time.

Reply on news.ycombinator.com