Deep understanding of Centos File System

Source: Internet
Author: User

1. Why can the files in the rm-rf directory be recovered after being deleted?

First, create an empty directory test. The blocksize of the directory is 4096 bytes.

For an empty directory or 4096? First, the directory size depends on the inode (access time, number of bytes of the file, uid and gid) of the file it contains. The size of 4096 is planned when the file system is created. You can use dumpe2fs to view

The default blocksize of the root partition is 4096.

Next, we will continue to create 1000 files in the new test directory.

1 for ((i= 0 ;i< 1000 ;i++)); do touchfile$i;done

Because 1000 new files are created, the blocksize of the test directory also increases. Then, we delete all the files under the test directory and check the test directory again. The directory is empty, but the bocksize of the Directory itself remains unchanged, which is the principle of "data recovery": Because rm-rf only deletes the descriptor (dirfd) related to the directoryentry and datablocks, inodes and metadata are still in the disk.

You can use stace to check my thoughts. During the rm-rf process, two systemcalls are called: unlinkat () and fstatat64 ().

The systemcall function of fstatat () is getfilestatusrelativetoadirectoryfiledescriptor.

Unlinkat () The systemcall function is removeadirectoryentryrelativetoadirectoryfiledescriptor.

It can be seen that the deletion process only obtains the state of the file related to the description of the directory file and deletes the file descriptor corresponding to the directoryentry (in fact, the content of the "directory" is a long string of data structures of the directoryentry, directoryentry is used to describe the file name and inode address. Because datablocks, inodes, and metadata stored in inodes (file size, relationship, etc.) still exist in the disk, therefore, the directory size remains unchanged after the files in the directory are deleted.

Therefore, it is easy to use photorec to restore the deleted files.

2. About using vim to edit the file size

We create a file, and vim opens the input content "1234567" in 7 bytes.

Check that the file size is 8 bytes.

If you use od to view data, vim will automatically add a byte \ n line break, so 7 bytes will be changed to 8 bytes.

3. soft connection size

First, create a soft connection named install for the install. log File to check that the soft connection install is 11 bytes in size. Why is it 11 bytes? The number of file names in the original file is 11 bytes, which is correct.

4. How to delete an object

1. when you delete a file descriptor (filedescriptor), you can see from the first question that the deleted file can be recovered after executing rm-rf *. That is to say, the file data can still be accessed, it is because datablocks, inodes, and inodes store metadata on disks.

2. To delete metadata (metadata), you can use> filename. The actual data in datablock remains in the disk.

3. to delete the real data (datablock), you need to generate some random number filling files and then delete the files.

The order is ddif =/dev/randomof = filename and then rm-rffilename

In this way, the real data will be deleted. The faster method is to use the device/dev/urandom. However, although there is no/dev/random randomness, it can be used to erase disk data.

Why is it better to use the/dev/random device than to use the/dev/zero device?

Both devices read previous data records (datatrace). Using/dev/zero makes it easier to read previous data records (datatrace) than using/dev/random devices ).

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.