question about inode

[Steve_393]

1.Whether the system only delete the inode or inode and data in the data blocks when I use "rm" command to delete a file?

2.Can I recovery the data I deleted ?

Thanks

[Con O'Kelly · Accepted solution]

Hi Steve

Only the inode entry is deleted in the inode table, hence freeing up the blocks to be written to.

Recovering data after the "rm" is difficult. The first thing is to ensure no more data is written to that filesystem.

Check this link for recovery UNIX files:
http://www.samag.com/documents/s=1441/sam0111b/0111b.htm

Cheers
Con

[Michael Tully]

Once data has been removed, it is gone. There is no undelete facility. You will need to get your last backup tape.

[James Murtagh]

Hi Steve,

Only the inode is deleted initially, although if the filesystem is active in write terms the data may well be overwritten. The only way I know of to recover the data is if you know the position on the disk that the data was located. This is normally done using fsdb so I suspect you don't. There are certain companies that do retrieve this sort of data but the expense is high....if the data is very important then I guess it should be on a recent backup.....

Cheers,

James.

[A. Clay Stephenson]

When you rm a file (actually the unlink() system call is invoked) the directory entry is marked blank and the link count is reduced by one. When the link count goes to zero AND all the processes which had the file open either close the file or terminate then the inode is placed on the free list. Nothing is actually done to the data itself. On a busy filesystems portions of the original file are typically overwritten very quickly. If you are very fortunate, you can unmount the filesystem and remount it as read-only and use tools like fsdb or dd to recover the files -- or at least parts of it but, in general, the answer to your question is that when it's gone, it's gone.

[amit singh_3]

hey stew,

When ever Ur deleting any file its inode is
placed from occupied table to free table in
master block.
try the following exercise to understand the things,

#touch test1
#ls -lin test1
->it will show U the inode number,remeber the
inode number.

#rm -rf test1
-> now the file is deleted & inode number will become free.

#touch test2
#ls -nli test2
-> it will assign the inode number of deleted file to the new file.
provided no one has created any file before that.and U should be there in the same file system.

byee

Amit singh