On Sun, Mar 14, 2021 at 10:28:32PM -0700, Marc Shapiro via Dng wrote:
>
> On 3/14/21 10:09 PM, Ludovic Bellière wrote:
> > I assume you read the man page of fsck, as it's return code is what you
> > want to pay attention to.
> >
> > As for lsof, the correct parameters would be `lsof +aL1 /dev/sdx. It
> > should have thrown an error were you to use `lsof -L1`. If lsof returns
> > nothing, your drive is most likely corrupted.
> You are correct.  I used '+L' NOT '-L'.
> > It may also be possible that the files you removed have other
> > references on your file system, aka. hard links. To find them, you
> > would need to know the inode number, either by using `stat` or `ls -i`.
> > You can then find them using `find -inum`.
> >
> > Since you already removed the files, you most likely can't know the
> > inode number. However you could throw a `find $path -size n[cwbkMG]` to
> > list the files with the matching size.
>
> I'm not following you on this.  What is this going to do for me? 'find' is
> only going to show undeleted files.  How does this help?

It is possible for a single file to be hard-linked in several places in the
file system. If so, removing it in one place will still leave it accessible
from another, and therefore not deleted.

Files have reference counts to keep track of this.

-- hendrik