From 4e29280cb2f20e9886cd642c8b2889b1de9aee4e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jean-Pierre=20Andr=C3=A9?= Date: Wed, 21 Mar 2012 19:14:03 +0100 Subject: [PATCH] Kept the name of a deleted file in place for easier undeletion When a file is deleted, there is no need to remove its last name in the deleted MFT record. The name may be useful for undeleting the file later (Windows also does not delete the name). --- libntfs-3g/dir.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/libntfs-3g/dir.c b/libntfs-3g/dir.c index ea31535b..b0d50931 100644 --- a/libntfs-3g/dir.c +++ b/libntfs-3g/dir.c @@ -1878,8 +1878,18 @@ search: if (ntfs_index_remove(dir_ni, ni, fn, le32_to_cpu(actx->attr->value_length))) goto err_out; - if (ntfs_attr_record_rm(actx)) - goto err_out; + /* + * Keep the last name in place, this is useful for undeletion + * (Windows also does so), however delete the name if it were + * in an extent, to avoid leaving an attribute list. + */ + if ((ni->mrec->link_count == cpu_to_le16(1)) && !actx->base_ntfs_ino) { + /* make sure to not loop to another search */ + looking_for_dos_name = FALSE; + } else { + if (ntfs_attr_record_rm(actx)) + goto err_out; + } ni->mrec->link_count = cpu_to_le16(le16_to_cpu( ni->mrec->link_count) - 1);