EXT3 file recovery

[Theodore Tso]

On Wed, Apr 29, 2009 at 09:26:29PM +0530, ranjith kannikara wrote:
> Hi all,
>
> Thanks to get such fast and useful replies. I would like to ask one
> more that Can some one tell me where to find the code for the
> procedure 'delete'. ie the code that runs when a file is deleted
> from an ext3 filesystem.. where is this code placed.

I'm not sure why you would find that all that helpful, but please see
ext3_unlink(), ext3_delete_entry, ext3_delete_inode(),
ext3_truncate(), ext3_orphan_add(), and ext3_orphan_cleanup().  The
actual work of deleting a file is scattered across all of these
functions, plus work at the VFS layer.

It may be simpler for you to see what happens when you delete a file
by looking at the userspace code in e2fsprogs.  If you look at do_rm()
in debugfs/debugfs.c, and then trace through its function calls,
starting with unlink_file_by_name() and kill_file_by_inode() in
debugfs.c, and seeing how it calls out to the libext2fs functions
ext2fs_unlink(), ext2fs_block_iterate(), and in the callback
release_blocks_proc() passed to ext2fs_block_iterate,
ext2fs_block_alloc_stas(), that might be easier to understand.

Or, of course, I recommend you look at the various papers that talk
about the ext3 and ext4 filesystem formats at:

      http://ext4.wiki.kernel.org/index.php/Publications

Best regards,

					- Ted