Re: How To Recover Files From ext3 Partition??

[Andreas Dilger <adilger@clusterfs.com>]

On May 05, 2006  13:18 +0200, Erik Mouw wrote:
> Andreas, care to elaborate? AFAICS resetting ->i_mode to 0000, setting
> ->i_links_count to 0, and setting ->i_dtime should be enough to
> uniquely mark an inode as deleted. Doing so would make an occasional
> undelete much easier to recover for Joe Sixpack (and for us a lot less
> work to reconstruct files by scavenging the whole partition for clues).

Yes, while this would mark the _inode_ unused, it does nothing to
mark the blocks unused in the block bitmaps (of which there may be
many thousand/million in a single file).  So ext3 needs to be able to
mark these bitmap blocks unused when the file is unlinked/truncated.
Otherwise each crash would leak blocks that can't be recovered except
by full e2fsck.

There is another mechanism ext3 could potentially use, wherein it
walks the whole inode in advance of the truncate and creates a
(potentially) very large transaction handle to do the bitmap updates
in a single shot (and also reducing the amount of IO needed for an
unlink by 96%), but nobody has ever cared enough about it to work on
implementing this.

Cheers, Andreas
--
Andreas Dilger
Principal Software Engineer
Cluster File Systems, Inc.