I'm an amateur programmer. I have a lot of interest in the inner workings of operating systems, a subject that I've been reading a lot about.

What I've understood about kernels is that on most operating systems, a process is not able to access the hard disk (or other storage media) directly, but rather through system calls. So, for example, when a process wants to handle files, it asks the kernel to do it on its behalf rather than writing/reading the disk directly.

Now, I've also understood that when files are deleted, they usually are not actively overwritten by the kernel but just marked as unused so that they can be overwritten when space is needed. This means that even if I've deleted a file, it might still be recoverable as long as it hasn't been overwritten yet (it's just sitting on the hard drive).

This can pose somewhat of a security risk if I dump my hard drive, or an opportunity to recover accidentally deleted files. So there are software to both recover deleted files or purge the hard drive of deleted, but not yet overwritten files. Here is my guess on how they work: For recovery, we basically just scan the hard drive, looking for sections of data marked as available to see if our file is still there (apparently sections/chunks of data have metadata signifying things like availability, file name). Then if we find our file, we just mark it back as non-available. For purging the drive, the software probably just writes zeroes or something over the old data.

But my question is (if my guess about the workings of these kind of software is right): How can an application do this, since it is not part of the kernel? The kernel has a very defined API for file handling, and if we ask it to delete a file it will do so in its own manner and there should be nothing we can do about as normal applications. So how do these kind of software work? How can I build a program that accesses the hard drive in free manner?

  • The short answer is that this kind of software has its own "kernel." – Robert Harvey Nov 13 '18 at 23:30
  • @RobertHarvey that is one answer but not the only answer. – whatsisname Nov 14 '18 at 1:32
  • @whatsisname: Which is why "kernel" is in quotes. – Robert Harvey Nov 14 '18 at 2:04
  • It's THE answer since the kernel IS software. You either roll up your sleeves and do it yourself or you ask someone elses code to do it for you. Simple as that. – candied_orange Nov 14 '18 at 2:25
  • This article explaining sdelete can be of interest. It's based on windows, but the general principles are applicable to other environments as well: docs.microsoft.com/en-us/sysinternals/downloads/sdelete – Christophe Nov 14 '18 at 7:23

The kernel has a very defined API for file handling

Right. And that API includes other more granular capabilities. There is an API to allow access to e.g. format a drive, get model and serial information, hard disk temperarure, and a variety of other things.

Some of the functions you are interested in are only available to privelged users, like root or Administrators.

The point is, the file API is extensive, with much more than just ordinary fopen() capabilities.

Look at FUSE for an example of how a kernel can expose these kinds of capabilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.