Can you recover deleted files in Unix ?!?

[Paul De Bra]

In article <34209 at apple.Apple.COM> ric at Apple.COM (Ric Urrutia) writes:
>In article <741 at ndcheg.cheg.nd.edu> kellow at ndcheg.cheg.nd.edu (John Kellow) writes:
>...
>I have never understood why the entire inode is zeroed out when a file is 
>removed.  I believe that a SVFS inode is "free" if the link count is 0.  If
>the removal of a file simply made the di_nlink field 0 and left the rest of
>the inode info intact, one would have a better chance of "undeleting" a file.  

A file with just di_nlink = 0 is not necessarily a deleted file. It is
simply a linkless file, still being accessed by a process. It MUST be
distinguished from deleted files somehow, otherwise the kernel can't know
which files are really deleted.
Furthermore, after a crash fsck can easily detect such linkless files
and reconnect them to lost+found, whereas it would not be able to
distinguish a linkless file from a deleted file if the inodes of deleted
files where not marked in a different way.

Now, one could imagine more friendly ways to distinguish a linkless file
from a deleted file, but at least the distinction is some motivation for
zeroing the inode.

Paul.
-- 
------------------------------------------------------
|debra at research.att.com   | uunet!research!debra     |
------------------------------------------------------