linux-ext4 - Re: undelete still opened file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 17 Oct 2008 09:24:43 -0400
From:	Theodore Tso <tytso@....edu>
To:	Lars Täuber <taeuber@...w.de>
Cc:	Manish Katiyar <mkatiyar@...il.com>, linux-ext4@...r.kernel.org
Subject: Re: undelete still opened file

On Fri, Oct 17, 2008 at 02:33:11PM +0200, Lars Täuber wrote:
> Is the space of the file on the underlying block device already
> marked as free? Or does this happen after all processes have closed
> all file descriptors pointing to the file?

No, the space on the file is not yet marked as free.  *However* for
ext3 and ext4, the inode has been placed on the orphaned inode list,
so that if the system crashes, part of the journal recovery process
will at that point free the blocks.

> I really want to undo the deletion. (get a link/name connected to
> the root inode of the file again) Is there a way to do this?

Not currently using ext3/ext4, no.  There would have to be an entirely
new system call or other userspace interface for something like this.

    	   	   	 	   	     	 - Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html