Can you recover deleted files in Unix ?!?

[Ric Urrutia]

In article <741 at ndcheg.cheg.nd.edu> kellow at ndcheg.cheg.nd.edu (John Kellow) writes:
>kellow at ndcheg.cheg.nd.edu (John Kellow) writes:
>
>Well, in answer to my own question - I did recover the important data
>that I had deleted.  I guess the answer would be no, you can't
>"undelete" files in SYSV.2 Unix but you can recover individual blocks
>of data.  It took a few hours of trying to decipher the manuals and
>some trial and error but I think I've got it figured out and its not
>too complicated (someone correct me if I'm wrong).  The actual blocks
>of data are not removed, only the inode entry.  Since the inode entry
>contains all of the information as to what blocks belong to what file
>and in what order, you can't very well "undelete" the file but the
>data might still be there and you can piece it back together by hand.

I have never understood why the entire inode is zeroed out when a file is 
removed.  I believe that a SVFS inode is "free" if the link count is 0.  If
the removal of a file simply made the di_nlink field 0 and left the rest of
the inode info intact, one would have a better chance of "undeleting" a file.  

Granted that if the file is quite large, certain blocks will be lost as they
are allocated for chaining the free list together.