What happens when you rm a file?

Question

I'm curious about what happens at a deeper level when you rm a file on a UNIX-like system, especially as related to how it's possible to restore deleted files.

Could someone describe how rm works at a fairly granular level?

Answer 1

rm calls the unlink system call. unlink() removes the directory entry, marks the inode for the file as free (resuable), and the disk driver removes supporting filesystem data (after a short while) on the disk.

For older systems: The actual physical data on disk sectors can still exist, but you cannot get to it. None of the old data is guaranteed to persist.

Windows developers came up with the undelete idea, I believe. This requires special handling for deleted files. Most older UNIX/linux file systems and drivers do not support an undelete operation. The ext3 and ext4 filesystems do. Modern linux supports the extundelete command for ext3 and ext4.. This command rebuilds all of the file's old metadata that was sent to a temporary metadata store. extundelete functionality adds overhead that older UNIX systems were not able to easily support. There is also extra disk overhead as well.