What happens to the directory entry of a file when it is deleted using rm

What happens to the directory entry of a file when it is deleted using rm

Post by J Tro » Thu, 24 Jul 2003 11:09:49



Does anyone know what exactly happens to the directory entry of a file
when that file is deleted? (Assuming you used the standard rm command
and you are using the ext2fs) Is the entry zeroed out? Or is it
"simply included in the slack space of the previous entry" (the Grugq
-- Phrack, issue 59)?  I read the Design and Implementation of the
Second Extended Filesystem
(http://e2fsprogs.sourceforge.net/ext2intro.html), and it didn't
confirm the Grugq's claim.

I would appreciate any and all help.
Thanks,

--Trost

 
 
 

What happens to the directory entry of a file when it is deleted using rm

Post by Ken Kauffma » Fri, 25 Jul 2003 00:23:34



| Does anyone know what exactly happens to the directory entry of a file
| when that file is deleted? (Assuming you used the standard rm command
| and you are using the ext2fs) Is the entry zeroed out? Or is it
| "simply included in the slack space of the previous entry" (the Grugq
| -- Phrack, issue 59)?  I read the Design and Implementation of the
| Second Extended Filesystem
| (http://e2fsprogs.sourceforge.net/ext2intro.html), and it didn't
| confirm the Grugq's claim.
|
| I would appreciate any and all help.
| Thanks,
|
| --Trost

Instinct tells me its only marked as available in the file tables.  'Shred'
will actually overwrite the file.  I realize this is not a 100% answer.  It
does seem to me that if it zeros out the space for all rm's then it would be
an impact on performance, especially for large recursive deletes, so I doubt
that this occurs.

ken k

 
 
 

What happens to the directory entry of a file when it is deleted using rm

Post by Lew Pitche » Fri, 25 Jul 2003 04:41:12


Without hesitation, J Trost asserted (on or about 07/22/03 22:09) that:

Quote:> Does anyone know what exactly happens to the directory entry of a file
> when that file is deleted? (Assuming you used the standard rm command
> and you are using the ext2fs) Is the entry zeroed out? Or is it
> "simply included in the slack space of the previous entry" (the Grugq
> -- Phrack, issue 59)?  I read the Design and Implementation of the
> Second Extended Filesystem
> (http://e2fsprogs.sourceforge.net/ext2intro.html), and it didn't
> confirm the Grugq's claim.

In the 2.4.21 kernel source, fs/ext2/dir.c has the following comments
associated with the function that deletes directory entries...

   /*
    * ext2_delete_entry deletes a directory entry by merging it with the
    * previous entry. Page is up-to-date. Releases the page.
    */

The code seems to do what the comment suggests that it does.

--
Lew Pitcher

Master Codewright and JOAT-in-training
Registered Linux User #112576 (http://counter.li.org/)
Slackware - Because I know what I'm doing.