Path: utzoo!utgpu!news-server.csri.toronto.edu!smoke.cs.toronto.edu!rayan
Newsgroups: comp.unix.wizards
From: rayan@cs.toronto.edu (Rayan Zachariassen)
Subject: Re: unix undelete ????? (bsd ffs inode zeroing q.)
Message-ID: <91Apr28.141321edt.364@smoke.cs.toronto.edu>
Organization: Department of Computer Science, University of Toronto
References: <26647@adm.brl.mil> <1102@mwtech.UUCP>
Date: 28 Apr 91 18:13:47 GMT
Lines: 12

Since this is supposed to be unix-wizards how about this modified Q:

In the BSD FFS (at least), whenever an inode is deallocated it is very
thoroughly zero'ed out and then written to disk.  In particular, the
block pointers and size field all get nuked.  I think this was intended
to help fsck with its job, but I can't see why it is *necessary* to use
this particular destructive technique instead of some other flag.  If the
information was kept, an inode-based undelete would be practical.  I'm
upset 'cuz this field-nulling business cost a friend and I a couple of
days once in retrieving a file.  Mutter.  Chris?...

rayan