Hi,

I am Mahesh, part of the team that is working on a tool to undelete the files on ext3 file system.

One of the ideas on which the tool is based is “the rm command marks the inode free but does not zero out the data blocks and the indirect blocks”

While this is validated to be true on my version of Linux, Ubuntu 16.04, some of my friends using fedora found out that the indirect blocks at the 13^th pointer of the inode is indeed being zeroed.

This difference of behavior is seemingly mysterious to me. Request you to point me in the direction as to why only some distributions of Linux seems to zero out the indirect block pointers associated with the files.

Thanks,

Mahesh.