Xref: utzoo comp.unix.questions:6723 comp.unix.wizards:8063
Path: utzoo!mnetor!uunet!husc6!purdue!umd5!mimsy!chris
From: chris@mimsy.UUCP (Chris Torek)
Newsgroups: comp.unix.questions,comp.unix.wizards
Subject: Re: Recovery of removed files
Message-ID: <11236@mimsy.UUCP>
Date: 26 Apr 88 23:42:29 GMT
References: <367@axis.fr> <54@lakart.UUCP> <1079@mcgill-vision.UUCP>
Organization: U of Maryland, Dept. of Computer Science, Coll. Pk., MD 20742
Lines: 19

[N.B.: There are two kinds of `deleted' files: those the user has asked
to be deleted and those that have in fact been deleted; the latter is
what `rm' implements, and what is being discussed.  In *all* systems,
even those with deferred deletion, files are eventually removed, and
that is where this becomes relevant.]

In article <1079@mcgill-vision.UUCP> mouse@mcgill-vision.UUCP (der Mouse)
writes:
>I looked at [recovering the original file blocks] for 4.3[BSD].
>... I considered leaving the [inode] block pointers around ... so
>if you caught it before the blocks got reused (always a requirement),
>you could see the pointers still there.

The main reason the block pointers are clobbered is for crash
recovery.  If you change this you may have to work on fsck.  It
is not something to be undertaken lightly.
-- 
In-Real-Life: Chris Torek, Univ of MD Comp Sci Dept (+1 301 454 7163)
Domain:	chris@mimsy.umd.edu	Path:	uunet!mimsy!chris