undelete (-W) with rm (BSD General Commands) - Operation not supported
-
15-04-2021 - |
Pergunta
How to enable undelete for files in my Downloads
folder? How does this undelete
works?
$ rm backupstore.files.tar.gz
$ rm -W backupstore.files.tar.gz
rm: backupstore.files_.tar.gz: Operation not supported
$ ls -W
AdBlock.safariextz launch (1).ica mysql-connector-java-2.0.14.tar.gz launch.ica mysql-connector-java-5.1.41.tar.gz
$ rm launch.ica
$ rm -W launch.ica
rm: launch.ica: Operation not supported
Infos about the filesystem
$ diskutil info /dev/disk1
Device Identifier: disk1
Device Node: /dev/disk1
Whole: Yes
Part of Whole: disk1
Device / Media Name: APPLE SSD SM0512G
Volume Name: Macintosh HD
Mounted: Yes
Mount Point: /
Content (IOContent): Apple_HFS
File System Personality: Journaled HFS+
Type (Bundle): hfs
Name (User Visible): Mac OS Extended (Journaled)
Journal: Journal size 40960 KB at offset 0x11991000
Owners: Enabled
OS Can Be Installed: Yes
Recovery Disk: disk0s3
Media Type: Generic
Protocol: PCI
SMART Status: Not Supported
Volume UUID: D27270EB-9784-3B29-A1EE-D26DBC2BD22E
Disk / Partition UUID: FC74BE3D-F4EA-4FD1-B362-D651EB68CFA1
Disk Size: 499.0 GB (499046809600 Bytes) (exactly 974700800 512-Byte-Units)
Device Block Size: 512 Bytes
Volume Total Space: 499.0 GB (499046809600 Bytes) (exactly 974700800 512-Byte-Units)
Volume Used Space: 104.3 GB (104267853824 Bytes) (exactly 203648152 512-Byte-Units) (20.9%)
Volume Available Space: 394.8 GB (394778955776 Bytes) (exactly 771052648 512-Byte-Units) (79.1%)
Allocation Block Size: 4096 Bytes
Read-Only Media: No
Read-Only Volume: No
Device Location: Internal
Removable Media: Fixed
Solid State: Yes
Virtual: Yes
OS 9 Drivers: No
Low Level Format: Not supported
This disk is a Core Storage Logical Volume (LV). Core Storage Information:
LV UUID: FC74BE3D-F4EA-4FD1-B362-D651EB68CFA1
LVF UUID: 544B362A-53F4-41FF-B1AD-BE52860C04CA
LVG UUID: C92FBB59-95F2-4E6B-AABA-39267836FCE3
PV UUID (disk): 6C0409A0-8BBB-4BFC-B422-37782F7EA2B5 (disk0s2)
Fusion Drive: No
Encrypted: No
Solução
From man rm
:
-W Attempt to undelete the named files. Currently, this option can only be
used to recover files covered by whiteouts.
So it can't be used to recover files deleted by the usual means.
For a (rather short) explanation of whiteout see https://askubuntu.com/questions/39826/what-does-whiteout-mean-in-a-copy-on-write-filesystem. A slightly better explanation I found on discussions.apple.com:
A whiteout node is used are part of a union file system mount, where a 2nd file system is mounted over a base file system, and the files in both file systems appear to be merged.
When you delete a file in the union file system which happens to be in the bottom layer (which is effectively read-only), the top layer gets a whiteout node created to indicate that the bottom layer file should not be returned on a directory lookup.
So while I did not find anything about deleting a whiteout node, my theory is that maybe if you create a real file or directory with the exact same name as the whiteout node you created, the file system will automatically remove the whiteout node. Or try renaming a file to the same name as the whiteout node.