Re: Ext2 zeros inode in directory entry when deleting files.

[tytso@mit.edu]

On Sat, Mar 16, 2002 at 12:24:15AM -0800, Paul Allen wrote:
> While helping a friend recover from a catastrophic "rm -rf" accident,
> I discovered that deleted files have the inode number in their old
> directory entries zeroed.  This makes it impossible to match file
> names with recovered files.  I've verified this behavior on Mandrake
> 8.1 with Mandrake's stock 2.4.8 kernel.  In my kernel sources and
> in the stock 2.4.8 sources, the function ext2_delete_entry() in
> fs/ext2/dir.c has this line:
> 
> 	dir->inode = 0;
> 
> Now, I'm tempted to comment the line out in my kernel and see
> what happens.  But it does occur to me that hackers with more
> experience than I may zeroing the inode number for a reason and
> may be depending on it elsewhere in the kernel.  Or perhaps the
> ext2 flavor of fsck will malfunction if deleted directory entries
> have a non-zero inode?

Um....  the way directory entries are marked as deleted is by zeroing
out the inode number.

So if you take out that line, deleted files will appear not to be
deleted, the kernel will get confused, and you can be sure that fsck
will complain.

						- Ted