>> Miquel van Smoorenburg <miquels@cistron.nl> wrote:
[...]
>> I don't think those are desirable properties of an unlink() operator.
>Indeed, because a single line of extra code in ext2's debugfs makes
>undelete possible as long as the file hasn't been physically overwritten
>yet.
But, unless I'm mistaken, it can't tell you whether or not this has
happened. It will give you a count of which of the file's blocks are
currently free - but these could have been used subsequently by
another, now deleted, file.
So after undeleting you would have to manually check what was
recovered for the presence of garbage (or bits of
/some-file-you-weren't-supposed-to-see).
ray
--
Ray Auchterlounie Research Student (still) at:
<rda@kythera.demon.co.uk> Signal Processing Group
<rda@eng.cam.ac.uk> Cambridge University Engineering Dept.
"Don't ask me about my thesis (TM)"