Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP Path: utzoo!linus!philabs!cmcl2!harvard!husc6!talcott!panda!genrad!decvax!ittatc!dcdwest!sdcsvax!sdcrdcf!burdvax!psuvax1!psuvm.bitnet!ukma!ukecc!edward From: edward@ukecc.UUCP (Edward C. Bennett) Newsgroups: net.unix-wizards,net.sources.bugs Subject: What happens during an unlink(2) Message-ID: <422@ukecc.UUCP> Date: Sat, 26-Apr-86 17:46:15 EDT Article-I.D.: ukecc.422 Posted: Sat Apr 26 17:46:15 1986 Date-Received: Fri, 2-May-86 21:08:59 EDT References: <947@kitty.UUCP> <403@ukecc.UUCP> <979@kitty.UUCP> Organization: Univ. of Ky. Engineering Computing Center Lines: 35 Keywords: ``Relink'' April Fool Xref: linus net.unix-wizards:14934 net.sources.bugs:788 In article <979@kitty.UUCP>, larry@kitty.UUCP writes: >In article <403@ukecc.UUCP>, edward@ukecc.UUCP (Edward C. Bennett) writes: >> >> But you can recover an unlinked file! I know, I've had to do it. >> You must unmount the file system and search the free list for your data. >> It's a PITA, but worth it if you lose something big. > > I don't claim to be a UNIX internals expert (I have enough trouble > writing I/O drivers :-) ), but don't most ports of UNIX zero disk blocks after > an unlink(2)? As I seem to recall, unlink(2) is derived from unlink.s, which > is assembly language specific for the given machine. And unlink.s contains > a routine _unlink which fills the disk blocks with .word defined as 0x0000. When you unlink a file, the disk block addresses in the inode are zeroed, not the actual data blocks. Zeroing the inode is tantamount to 'forgetting' where the data is actually stored. The 'forgotten' data blocks are added to the (top of the) free list to be used when adding data to the filesystem. When the old data blocks are placed in the free list, their contents are unimportant. Zeroing the blocks would be a waste of time since whatever is there will be overwritten when the blocks are allocated to another file. This situation is identical to the malloc()/free() process. i.e. Space that has been malloc()ed will have data written into it. When this space is free()ed, the data in it is not altered and is useable until the next malloc(). -- Edward C. Bennett UUCP: ihnp4!cbosgd!ukma!ukecc!edward Kentucky: The state that is being dragged, kicking and screaming, into the 20th century. "Goodnight M.A."