![]() Tools like lsof can expose these otherwise invisible files if you look for files with a link count (NLINK) of zero. Opening a file and immediately unlinking it is actually a common practice for creating secure, temporary files. The reason is that the disk blocks remain inuse until the last process using the file terminates. ![]() Most often the reason is that an open file has been removed, so that it is no longer represented in its directory. It is often confusing to administrators to find that a filesystem is utilizing very large amounts of space that can't be accounted for by the simple summation of disk blocks (with something like du). This only happens when no processes have the file open. If this value reaches zero, the file is deleted from the filesystem directory and its disk blocks freed for re-use. Unlinking a file decrements the file's inode link-count. This sets the stage for the next part of this discussion, below. ![]() I use the unlink term since this is the underlying system call associated with a shell's rm command. The MacOS also has a secure remove command ( srm) which over-writes a file before it is unlinked making it unrecoverable. The central issue is that nothing else re-uses any of the disk blocks represented by your file. There are also some recovery tools which can be purchased to recover the loss. If you could quiesce the filesystem in which the file had been, there are advanced methods by which you can try to re-discover those blocks contents. ![]() Strictly speaking (as points out) a rm simply deletes the directory entry for the file while leaving the disk blocks it used, untouched. you have Time Machine running) then you are saved. The GUI interface allows you to move a file to the trash (which you can then recover) but that's not what you did. MacOS is a Unix OS and rm means "good-bye". ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |