I’ve an old HDD from an ex-windows build it has some data on it I want to keep (and I’ve currently nothing on hand big enough to move it on to) also while I shuffle some drives around I want to throw some more data onto it but there’s 40gb of WindowsApps crap on there that Linux is refusing to rm -rf for permissions reasons.
root has ownership of the folder.
the drive is in r/w mode and root has r/w permissions to all files under that directory (I’ve deleted a bunch of files from it already).
getfacl shows root with rwx permissions on the files it’s complaining about.
Yup, that was the first thing I tried
… Which to my knowledge as long as there’s no additional ACL or immutable flag on the thing (which I can’t see) should nuke the thing… But nope
changing the permissions and attributes of the files and folders should allow you to read/ write copy and delete these files.
if the files were password protected you may have an issue. hirens bootcd can remove any passwords associated with the drive and often the files as well.
one other thing to note If the files were set up as ghost files trying to delete them can be a headache in itself
(you can easily create a ghost file or ghost directory by typing the space key first before any other letter) (while the space may not show on the screen it is still a character there as far as the computer is concerned)
without knowing this has been done it will appear as a hidden file but you cannot delete it.
knowing it was a ghost file you can delete it if you hit the space key before the rest of the filename.
If it was created by some one else you don’t know how many times they may have hit the space key, so its a gamble at best.
that trick also works with partitioning (the ghost partition is hidden from the os)
that trick was used a lot by criminals trafficking in illicit pornography.
often i run forensic software on drives to save documents for the prior owners before nuking the drive for reuse
in many cases irreplaceable photos were recovered for them
Can you delete anything?
You might find the Linux NTFS driver has actually mounted it read-only.
This is quite likely if it from Win8 or above and there is a “hibernate” / suspend to disk file present. Win8+ uses this for fast boot, and you can’t make any changes to the filesystem if the hibernate data is present (as they need to be kept in sync).
I’ve had this issue before. I can’t remember exactly what I did.
If you’re going to use it with Windows again, you can disable hibernation or do a full shutdown (holding SHIFT).
If not, Google suggests you can use ntfsfix on Linx to clear the hibernation data.
