Not able to modify inode metadata
0
votes
0
answers
73
views
I am working on a ext4 file-system tool that aims to delete files such that they are not recoverable later on. My goal is to clear the inode metadata of a deleted file, but despite my efforts, the changes I make to the inode metadata are not reflecting when I inspect the inode later using stat.
Here's the process I follow to modify the inode:
1. Fetch the inode using ext2fs_read_inode.
2. Modify the inode metadata by setting values like i_mode, i_links_count, etc., to zero or NULL.
3. Write the modified inode back to the filesystem using
ext2fs_write_inode.
void clear_inode_metadata(ext2_filsys &fs, ext2_ino_t inode_num)
{
ext2_inode inode;
ext2fs_read_inode(fs, inode_num, &inode);
inode.i_mode = 0;
inode.i_links_count = 0;
inode.i_size = 0;
inode.i_size_high = 0;
inode.i_blocks = 0;
memset(inode.i_block, 0, sizeof(inode.i_block));
ext2fs_write_inode(fs, inode_num, &inode); // Write the cleared inode back to disk
}
void delete_file(const string &path, ext2_filsys &fs, const string &device)
{
ext2_ino_t inode_num = fetch_file(path, fs, device);
if (inode_num != 0)
{
overwrite_blocks(fs, device, path); // traverses extents and writes random data
clear_inode_metadata(fs, inode_num);
}
}
The inode metadata stays the same even after invoking clear_inode_metadata()
.
Also I have a file recovery module that uses a disk snapshot to recover files and to my surprise it is able to recover the file even after I overwrite the file using overwrite_blocks()
. The snapshot stores extents used by an inode and the total size of the file.
My questions:
1. Why aren't the changes to the inode metadata reflecting after calling ext2fs_write_inode?
2. Why is the file recovery tool still able to recover the file after I overwrite its blocks?
Asked by Dhruv
(1 rep)
Apr 27, 2025, 08:14 AM
Last activity: Apr 27, 2025, 08:16 AM
Last activity: Apr 27, 2025, 08:16 AM