Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!iuvax!rutgers!dptg!ulysses!andante!alice!debra
From: debra@alice.UUCP (Paul De Bra)
Newsgroups: comp.unix.questions
Subject: Re: Can you recover deleted files in Unix ?!?
Message-ID: <9809@alice.UUCP>
Date: 23 Aug 89 02:27:11 GMT
References: <740@ndcheg.cheg.nd.edu> <741@ndcheg.cheg.nd.edu> <34209@apple.Apple.COM>
Reply-To: debra@alice.UUCP ()
Distribution: na
Organization: AT&T, Bell Labs
Lines: 26

In article <34209@apple.Apple.COM> ric@Apple.COM (Ric Urrutia) writes:
>In article <741@ndcheg.cheg.nd.edu> kellow@ndcheg.cheg.nd.edu (John Kellow) writes:
>...
>I have never understood why the entire inode is zeroed out when a file is 
>removed.  I believe that a SVFS inode is "free" if the link count is 0.  If
>the removal of a file simply made the di_nlink field 0 and left the rest of
>the inode info intact, one would have a better chance of "undeleting" a file.  

A file with just di_nlink = 0 is not necessarily a deleted file. It is
simply a linkless file, still being accessed by a process. It MUST be
distinguished from deleted files somehow, otherwise the kernel can't know
which files are really deleted.
Furthermore, after a crash fsck can easily detect such linkless files
and reconnect them to lost+found, whereas it would not be able to
distinguish a linkless file from a deleted file if the inodes of deleted
files where not marked in a different way.

Now, one could imagine more friendly ways to distinguish a linkless file
from a deleted file, but at least the distinction is some motivation for
zeroing the inode.

Paul.
-- 
------------------------------------------------------
|debra@research.att.com   | uunet!research!debra     |
------------------------------------------------------