Hiya,
the ext2 inode has a field i_dtime which is the deletion time.
Until today i thought that the deletion of a file removes the inode.
So does anyone know what the sense of this field is?
Thanks!
A:
You can't really remove an inode, it's still there in the table. You can only mark it as deleted.
unbeli
2010-06-22 10:17:22
+2
A:
From [1]:
The inode is marked as deleted by writing the i_dtime. Special fs tools [2] can analyse the file system and may still restore files by looking at those marked inodes -- until they are actually overwritten.
dantje
2010-06-22 10:20:07