How a file is deleted in ufs2?

[Eric Anderson]

Scott Long wrote:
> Diego Woitasen wrote:
>> I want to know how a file is deleted in a ufs2 filesystem, specifically
>> what happen with the information in the inode. The information is
>> deleted to or the inode is marked as free but the information (uid, gid,
>> blocks, times, etc) remains there?
>>
>> I read the chapter 8 of 'Design and implementation of FreeBSD" and "a
>> Fast file system for Unix", but i can't see the answer.
>>
>> Reading the code is an interesting choice, but is the last resource :)
>>
>>
>> thanks!
>>
>>
> 
> Two things happen when a file gets 'deleted'.  First is that the 
> directory entry for the filename gets cleared from the directory, and
> the reference count on the inode is decremented.  However, a 'file' can
> have multiple hard links, or it might still be opened by a program.
> So nothing further might happen until the reference count goes to 0.
> When that happens, the inode is zeroed and the free block bitmaps
> are updated to indicate that the data blocks and any indirect blocks
> have been freed.  Softupdates complicates this by ordering the 
> operations, but that's a whole other discussion.
> 
> But to specifically answer your question, when an inode gets freed it
> is also zeroed and any information in it is lost permanently.  It's
> not like MSDOS FAT where just a bit gets set in the directory entry
> and the information remains valid until it is re-allocated and 
> overwritten.  IOW, there is no easy way to undelete a file.


Hmm.. Can you explain then how a tool could recover rm'ed files (or just 
point me to the code snippet)?  There are a few tools that do this.  I 
was under the understanding that the direct/indirect/* lists got blasted 
away, but parts of the inode were left over.

Thanks!

Eric





-- 
------------------------------------------------------------------------
Eric Anderson        Sr. Systems Administrator        Centaur Technology
Anything that works is better than anything that doesn't.
------------------------------------------------------------------------