At what hard link count is a file effectively deleted?

Enhance your readiness for the Cengage Computer Forensics Test. Dive into flashcards and multi-choice quizzes with helpful hints and detailed explanations to boost your preparation efforts. Gear up for success!

Multiple Choice

At what hard link count is a file effectively deleted?

Explanation:
The important idea is that a file’s existence in the filesystem is tied to references to its inode. A hard link count tells you how many directory entries point to that inode. A file exists as long as there is at least one directory entry referencing it or at least one open file descriptor referring to it. When all directory entries that reference the file are removed, the hard link count drops to zero. At that moment, there is no name left in the filesystem that refers to that inode, so the file is effectively deleted from the namespace. The actual disk space is only reclaimed after the last open handle to the file is closed, but the moment the link count becomes zero, it is no longer accessible by any name. So zero is the point at which the file is effectively deleted.

The important idea is that a file’s existence in the filesystem is tied to references to its inode. A hard link count tells you how many directory entries point to that inode. A file exists as long as there is at least one directory entry referencing it or at least one open file descriptor referring to it. When all directory entries that reference the file are removed, the hard link count drops to zero. At that moment, there is no name left in the filesystem that refers to that inode, so the file is effectively deleted from the namespace. The actual disk space is only reclaimed after the last open handle to the file is closed, but the moment the link count becomes zero, it is no longer accessible by any name. So zero is the point at which the file is effectively deleted.

Subscribe

Get the latest from Passetra

You can unsubscribe at any time. Read our privacy policy