All geek questions in one place

Linux ext2 file system, why is there a delete time?

inode ext2 has an i_dtime field, which is the delete time.

Until today, I thought deleting a file deletes the index.

So does anyone know what is the meaning of this field?

Thank!

+3
source share
2 answers

From [1]:

The index is marked as deleted by writing i_dtime. Special tools fs [2] can analyze the file system and can restore files by looking at the marked indexes until they are overwritten.

+3
source

, . .

0

Source: https://habr.com/ru/post/1751171/

More articles:


All Articles