files recovery after rm?

[Dolf Grunbauer]

In article <2778 at uceng.UC.EDU> schriste at uceng.UC.EDU (Steven V. Christensen) writes:
>jlee at sysmgr.cs.uh.edu writes:
>>Are there any programs in the unix world for recovering files right after
>>they are removed by rm? 
>It would seem to me that this would be difficult, since when you remove
>a file, you free up the space for the system (or another process) to
>write over it. 
>On a PC you can recover files easier because you have 100% control of
>the processing. Who knows under Unix what other processes want to
>write to disk....

Apart from that, the PC (read: MS-DOS) does not remove the file, but marks
it as removed, and it does not free the associated disk blocks yet.
If a new file is created or an old one extended, MS-DOS searches first
for never used disk blocks, and if none found it starts reusing freed blocks.

Unix on the other hand uses a FIFO principle for free blocks. I.e. when a
file is 'rm'ed its blocks are put in (the front of) the free block list.
Anyone who needed a new free block will now get one of these most recently
freed blocks, thus destroying the removed file. (Assuming zero link count :-)

Also, MS-DOS links the used blocks in the FAT, which must be used to chain
the old blocks back to a complete file. Note that when a utility (like Norton)
says that the file could not be completely recovered, it tells you that at
least some blocks are reused, as it could not completely walk through this
old block list again.
Unix stores its block administration in a completely different way (using
I-nodes) and even uses normal blocks to store block numbers (for inderict
blocks). These I-nodes also use a FIFO mechanism, so the file administration
is also lost :-(
-- 
Dolf Grunbauer          Tel: +31 55 433233  Internet dolf at idca.tds.philips.nl
Philips Telecommunication and Data Systems  UUCP ....!mcvax!philapd!dolf
Dept. SSP, P.O. Box 245, 7300 AE Apeldoorn, The Netherlands
           --> Holland is only 1/6 of the Netherlands <--