> Oookay... Just enlighten me: how would a kernelspace-level solution be
> better than userspace-level solution?
>
> Remember the undelete command in DOS? It was a hack. Undelete
> feature was never thought of when DOS/FAT was designed. It was there by
> accident. You see, when you delete a file in DOS, you are not deleting as
> in deleting, but as in 'deleting'. :) That is, you are just MARKING them
> for deletion; the first character of the file is overrwritten with a
> special character (Now you know why UNDELETE ask you for the first
> character?). The link to the chain of clusters (or blocks for you UNIX
> geeks:) is still pointed by the file entry marked deleted.
You just answered your own question: a kernel space solution is needed to
prevent the undelete feature from being just a hack.
Johan Myreen
jem@iki.fi