Suppose we have a simple case:

  • ext4 file system with journaling
  • a single file named file, which has no other hard links
  • the inode for file has associated with it only 1 data block

My understanding of the deletion process for this specific case is as follows:

  1. log that we will delete file
    1. log that we will reduce inode's ref_cnt by 1
    2. commit
    3. log that because ref_cnt is 0, release inode back to pool
    4. commit
    5. log that because inode is released, release associated block back to pool
  2. commit deletion of file

Among these, how do I get the block number that was released from step 1.5? Is it stored in the journal? If so, how would I access it?

I have been searching for some interface to the filesystem that gives this information. The best I've come to is debugfs -R "logdump -a", but I'm not sure how to move forward from there.

NOTE: I understand that there are tools like ext3grep that will help me with recovering file. My goal is to try this manually by getting the block number out of the journal, for educational purposes. I also understand that the inode and block may be reused before getting this information. For the purposes of this question, assume that the filesystem is read-only after the delete is done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.