Linux文件系统：minix文件系统二进制分析4(rm删除)

系列博文

Linux文件系统：minix文件系统二进制分析1

Linux文件系统：minix文件系统二进制分析2

Linux文件系统：minix文件系统二进制分析3(硬链接与软链接)

目录结构

上一章节最后保持的目录结构

删除file.txt文件

 rm file.txt

现在的目录结构

二进制dump

hexdump -C /dev/sdb > chapter4.hex

  二进制内容如下：

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000400  60 15 00 40 01 00 02 00  b0 00 00 00 00 1c 08 10  |`..@............|
00000410  8f 13 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000420  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000800  37 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |7...............|
00000810  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000aa0  00 00 00 00 00 00 00 00  00 00 00 00 fe ff ff ff  |................|
00000ab0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00000c00  37 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |7...............|
00000c10  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000013e0  00 00 00 00 00 00 00 00  00 00 fe ff ff ff ff ff  |................|
000013f0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00001400  ed 41 00 00 00 01 00 00  78 b5 b2 61 00 03 b0 00  |.A......x..a....|
00001410  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00001420  ed 41 00 00 60 00 00 00  9d 1c a1 61 00 02 b1 00  |.A..`......a....|
00001430  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00001440  00 00 00 00 0c 00 00 00  77 1c a1 61 00 00 b2 00  |........w..a....|
00001450  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00001460  a4 81 00 00 08 00 00 00  9d 1c a1 61 00 02 b3 00  |...........a....|
00001470  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00001480  ff a1 00 00 16 00 00 00  7f 18 b0 61 00 01 b4 00  |...........a....|
00001490  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0002c000  01 00 2e 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c020  01 00 2e 2e 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c040  02 00 64 69 72 64 65 6d  6f 00 00 00 00 00 00 00  |..dirdemo.......|
0002c050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c060  00 00 66 69 6c 65 2e 74  78 74 00 00 00 00 00 00  |..file.txt......|
0002c070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c080  04 00 68 61 72 64 6c 69  6e 6b 32 66 69 6c 65 6c  |..hardlink2filel|
0002c090  65 76 65 6c 32 2e 74 78  74 00 00 00 00 00 00 00  |evel2.txt.......|
0002c0a0  05 00 73 6f 66 74 6c 69  6e 6b 32 66 69 6c 65 6c  |..softlink2filel|
0002c0b0  65 76 65 6c 32 2e 74 78  74 00 00 00 00 00 00 00  |evel2.txt.......|
0002c0c0  00 00 2e 73 77 70 00 00  00 00 00 00 00 00 00 00  |...swp..........|
0002c0d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c0e0  00 00 2e 73 77 70 78 00  00 00 00 00 00 00 00 00  |...swpx.........|
0002c0f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0002c400  02 00 2e 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c410  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c420  01 00 2e 2e 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c430  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
0002c440  04 00 66 69 6c 65 6c 65  76 65 6c 32 2e 74 78 74  |..filelevel2.txt|
0002c450  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0002c800  68 65 6c 6c 6f 20 6d 69  6e 69 78 0a 00 00 00 00  |hello minix.....|
0002c810  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0002cc00  6c 65 76 65 6c 20 32 0a  00 00 00 00 00 00 00 00  |level 2.........|
0002cc10  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0002d000  64 69 72 64 65 6d 6f 2f  66 69 6c 65 6c 65 76 65  |dirdemo/fileleve|
0002d010  6c 32 2e 74 78 74 00 00  00 00 00 00 00 00 00 00  |l2.txt..........|
0002d020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
01000000

删除file.txt后的二进制分析

data区的变化

  对比删除file.txt文件前后，根目录inode节点数据区的变化，可以看到file.txt文件的第一个字节由03变为了00，删除之前inode3为file.txt的inode节点，删除之后file.txt文件指向的inode为0，即空节点。

  可以得出结论：当我们在命令行下执行rm file.txt命令删除根目录下的file.txt文件后，内核并没有将根目录inode节点指向的数据区中关于file.txt的信息删除，仅仅是将其指向的inode节点由03修改为了00。

inode区的变化

  对比删除file.txt文件前后，inode区二进制数据的变化，如下图所示，可以看到inode3中的第14个字节由01变为了00，说明引用本节点的文件名为0个，即没有。前两个字节(文件的类型和权限属性)也变为了00 00。

file.txt文件的数据区

  对比删除file.txt文件前后,如下图所示，我们可以看到file.txt数据区的内容并未发生变化。

总结

  在linux执行rm操作，并未将操作的文件信息全部从硬盘上抹去，而是通过修改inode节点属性和文件所在目录的data区中相关文件指向的inode节点值来完成文件的删除操作，所以数据还是能恢复回来的。