linux-ext4 - Re: undelete still opened file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 17 Oct 2008 19:32:50 +0530
From:	"Manish Katiyar" <mkatiyar@...il.com>
To:	"Lars Täuber" <taeuber@...w.de>
Cc:	"Theodore Tso" <tytso@....edu>, linux-ext4@...r.kernel.org
Subject: Re: undelete still opened file

On Fri, Oct 17, 2008 at 7:09 PM, Lars Täuber <taeuber@...w.de> wrote:
> Hi Theodore,
>
>
> Theodore Tso <tytso@....edu> schrieb:
>> On Fri, Oct 17, 2008 at 02:33:11PM +0200, Lars Täuber wrote:
>> > Is the space of the file on the underlying block device already
>> > marked as free? Or does this happen after all processes have closed
>> > all file descriptors pointing to the file?
>>
>> No, the space on the file is not yet marked as free.  *However* for
>> ext3 and ext4, the inode has been placed on the orphaned inode list,
>> so that if the system crashes, part of the journal recovery process
>> will at that point free the blocks.
>
> not that it is a way I would go, but theoretically: I could provoke a crash and mount the ext3 filesystem as ext2 and restore the file?

Errr.... If I read the code correctly, once deleted the inode is added
to the orphan list and on recovery this orphan list is traversed and
iput will be called on each of the inodes. So even a crash will not
restore your inode on the contrary *it will make sure that the inode
is deleted*.


>
>> > I really want to undo the deletion. (get a link/name connected to
>> > the root inode of the file again) Is there a way to do this?
>>
>> Not currently using ext3/ext4, no.

Isn't it possible to some extent using ext3grep for ext3 ????


  There would have to be an entirely
>> new system call or other userspace interface for something like this.
>
> Is this planned?
>
> But a solution should be independent of the real filesystem.

No as I said...depending on the nature of filesystem it may be write
in place or it might write to a new block every time like logfs.  So
it is very much filesystem dependant.


Thanks -
Manish

>Because the file is still somewhere in the ram and represented in linux vfs, isn't it?



> It only needs to be copied/recreated on to a (different) filesystem somehow.
>
> Regards
> Lars
>
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html