zoukankan html css js c++ java

文件从开头删除几个字符，整个磁盘的变化

预备文章，熟悉Ext2文件系统。看前面的blog 分析Ext2文件系统结构

问题：

如果一个4G的文件，删除开始几个字节，底层磁盘会发生什么变化？

猜想：

在团队的分享讨论中，有人认为会有高效的方式，优化文件修改。让我们用实验测试一下，ext2文件系统具体是怎么执行的。

实践：

1. 采用 linux loop设备作为虚拟磁盘，并mount到一个文件。磁盘一共1000个block，每个block大小是512。（实践上创建完成之后，发现是500个block，每个block大小是1024，总容量没有变化。）

dd if=/dev/zero of=~/file.img bs=512 count=1000
LOOFDEV=`sudo losetup --find --show ~/file.img`
mkdir file.image.loop -p
sudo mkfs -t ext2 $LOOFDEV 
sudo mount  $LOOFDEV file.image.loop

获取块大小

BLOCKSIZE=`dumpe2fs ~/file.img | grep "Block size:" |  awk '{print $NF}'`

2. 查看文件系统详细信息

dumpe2fs ~/file.img

输入结果如下：

 1 dumpe2fs 1.44.1 (24-Mar-2018)
 2 Filesystem volume name:   <none>
 3 Last mounted on:          <not available>
 4 Filesystem UUID:          53664a8d-19e9-4cb3-9cd9-6c1c4f5f1598
 5 Filesystem magic number:  0xEF53
 6 Filesystem revision #:    1 (dynamic)
 7 Filesystem features:      ext_attr resize_inode dir_index filetype sparse_super large_file
 8 Filesystem flags:         signed_directory_hash
 9 Default mount options:    user_xattr acl
10 Filesystem state:         not clean
11 Errors behavior:          Continue
12 Filesystem OS type:       Linux
13 Inode count:              64
14 Block count:              500
15 Reserved block count:     25
16 Free blocks:              472
17 Free inodes:              53
18 First block:              1
19 Block size:               1024
20 Fragment size:            1024
21 Reserved GDT blocks:      1
22 Blocks per group:         8192
23 Fragments per group:      8192
24 Inodes per group:         64
25 Inode blocks per group:   8
26 Filesystem created:       Sun May 10 16:29:03 2020
27 Last mount time:          Sun May 10 16:29:04 2020
28 Last write time:          Sun May 10 16:29:04 2020
29 Mount count:              1
30 Maximum mount count:      -1
31 Last checked:             Sun May 10 16:29:03 2020
32 Check interval:           0 (<none>)
33 Reserved blocks uid:      0 (user root)
34 Reserved blocks gid:      0 (group root)
35 First inode:              11
36 Inode size:               128
37 Default directory hash:   half_md4
38 Directory Hash Seed:      97e7d950-9ee2-405e-9dfa-f36c2ff7baa5
39 
40 
41 Group 0: (Blocks 1-499)
42   Primary superblock at 1, Group descriptors at 2-2
43   Reserved GDT blocks at 3-3
44   Block bitmap at 4 (+3)
45   Inode bitmap at 5 (+4)
46   Inode table at 6-13 (+5)
47   472 free blocks, 53 free inodes, 2 directories
48   Free blocks: 28-499
49   Free inodes: 12-64

14行显示，有500个块

16行显示，空闲块是472个。

19行显示，每个块大小是1024字节。

3. 创建一个文件，写入3个块（实际是4给块，最后一个块是EOF）

cd file.image.loop/
COUNT=$BLOCKSIZE 
python -c "print('a' * $COUNT + 'b' * $COUNT + 'c' * $COUNT)" |sudo tee a.txt

写入1024个字母“a”（HEX 61，DEX97 ）

写入10024个字母“b”（HEX 62，DEX98 ）

写入10024个字母“b”（HEX 63，DEX99 ）

4. 查看文件字节数

ls查看

ls -l a.txt
-rw-r--r-- 1 root root 3073 5月  10 16:42 a.txt

wc点字节数

cat a.txt |wc -c
3073

5. 查看文件的具体信息

sudo debugfs $LOOFDEV  <<< "stat a.txt"

输出如下结果：

Inode: 12   Type: regular    Mode:  0644   Flags: 0x0
Generation: 2365015721    Version: 0x00000001
User:     0   Group:     0   Size: 3073
File ACL: 0
Links: 1   Blockcount: 8
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x5eb7be5a -- Sun May 10 16:42:02 2020
atime: 0x5eb7bea6 -- Sun May 10 16:43:18 2020
mtime: 0x5eb7be5a -- Sun May 10 16:42:02 2020
BLOCKS:
(0-3):28-31
TOTAL: 4

数据位于28-31的磁盘块中。

获取起始块和长度

BNUM=`sudo debugfs $LOOFDEV  <<< "blocks a.txt" |grep -o "^[0-9 ]*" |cut -d " " -f1`
BLEN=`sudo debugfs $LOOFDEV  <<< "blocks a.txt" |grep -o "^[0-9 ]*" |wc -w`

6. 查看文件对应的block内容

sudo dd if=$LOOFDEV bs=$BLOCKSIZE count=$BLEN skip=$BNUM | od -t x1 -Ax

输入如下内容

4+0 records in
4+0 records out
4096 bytes (4.1 kB, 4.0 KiB) copied, 8.578e-05 s, 47.8 MB/s
000000 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61
*
000400 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62
*
000800 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63
*
000c00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000c10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
*
001000

删除四个字符

sudo sed -i -r '1s/.{4}//' a.txt
cat a.txt |wc -c

再次查看文件内容

sudo dd if=$LOOFDEV bs=$BLOCKSIZE count=$BLEN skip=$BNUM | od -t x1 -Ax

没有发生变化，同步数据到磁盘也没有发生变化

sync -f a.txt

这是因为文件的inode和block发生了变化，但是原来存储数据的block并没有擦除。这就是为什么一些磁盘恢复工具能恢复数据的原理。

7. 重新查看文件的具体信息

sudo debugfs $LOOFDEV  <<< "stat a.txt"

显示结果如下：

Inode: 13   Type: regular    Mode:  0644   Flags: 0x0
Generation: 1601438359    Version: 0x00000001
User:     0   Group:     0   Size: 3069
File ACL: 0
Links: 1   Blockcount: 6
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x5eb7c5b5 -- Sun May 10 17:13:25 2020
atime: 0x5eb7c5b8 -- Sun May 10 17:13:28 2020
mtime: 0x5eb7c5b5 -- Sun May 10 17:13:25 2020
BLOCKS:
(0-2):32-34
TOTAL: 3

我们可以看到block，从前面的28-21移动到了32-34

8. 再次获取新的数据块起始和长度

注意，实际中，数据块不一定是连续的，本实验是因为采用了一个全新的空磁盘。或者再做一次实验，就会发现数据块，可能不连续了。

BNUM=`sudo debugfs $LOOFDEV  <<< "blocks a.txt" |grep -o "^[0-9 ]*" |cut -d " " -f1`
BLEN=`sudo debugfs $LOOFDEV  <<< "blocks a.txt" |grep -o "^[0-9 ]*" |wc -w`

查看文件对应的block内容

sudo dd if=$LOOFDEV bs=$BLOCKSIZE count=$BLEN skip=$BNUM | od -t x1 -Ax

内容如下，已发生变化

3+0 records in
3+0 records out
3072 bytes (3.1 kB, 3.0 KiB) copied, 0.000226374 s, 13.6 MB/s
000000 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61
*
0003f0 61 61 61 61 61 61 61 61 61 61 61 61 62 62 62 62
000400 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62 62
*
0007f0 62 62 62 62 62 62 62 62 62 62 62 62 63 63 63 63
000800 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63 63
*
000bf0 63 63 63 63 63 63 63 63 63 63 63 63 0a 00 00 00
000c00

9. 清理环境

首先查看还有没有进程打开该磁盘，有的话，kill该进程

sudo lsof $LOOFDEV

cd ..
sudo umount  $LOOFDEV
sudo losetup -d $LOOFDEV
rm file.img -rf
rm file.image.loop -rf

结论：

整个磁盘都会移动，这其实是最好的方式，所有数据都是循序读写。

修改一个文件，其实就是创建了一个新文件，inode和磁盘数据都会发生变化。

这是由于文件系统，只提供了read和write的操作，并没有提供插入和删除的操作，其实是应用程序实现了新建文件的操作。

我们可以实现sed过程的strace

  1 sudo strace sed -i -r '1s/.{4}//' a.txt
  2 execve("/bin/sed", ["sed", "-i", "-r", "1s/.{4}//", "a.txt"], 0x7ffcf1b4cfe0 /* 24 vars */) = 0
  3 brk(NULL)                               = 0x564cef104000
  4 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
  5 access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
  6 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
  7 fstat(3, {st_mode=S_IFREG|0644, st_size=167308, ...}) = 0
  8 mmap(NULL, 167308, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f9820a7a000
  9 close(3)                                = 0
 10 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
 11 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
 12 read(3, "177ELF2113>120b"..., 832) = 832
 13 fstat(3, {st_mode=S_IFREG|0644, st_size=154832, ...}) = 0
 14 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9820a78000
 15 mmap(NULL, 2259152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f9820654000
 16 mprotect(0x7f9820679000, 2093056, PROT_NONE) = 0
 17 mmap(0x7f9820878000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x24000) = 0x7f9820878000
 18 mmap(0x7f982087a000, 6352, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f982087a000
 19 close(3)                                = 0
 20 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
 21 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
 22 read(3, "177ELF21133>1260342"..., 832) = 832
 23 fstat(3, {st_mode=S_IFREG|0755, st_size=2030544, ...}) = 0
 24 mmap(NULL, 4131552, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f9820263000
 25 mprotect(0x7f982044a000, 2097152, PROT_NONE) = 0
 26 mmap(0x7f982064a000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e7000) = 0x7f982064a000
 27 mmap(0x7f9820650000, 15072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9820650000
 28 close(3)                                = 0
 29 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
 30 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpcre.so.3", O_RDONLY|O_CLOEXEC) = 3
 31 read(3, "177ELF2113>1 25"..., 832) = 832
 32 fstat(3, {st_mode=S_IFREG|0644, st_size=464824, ...}) = 0
 33 mmap(NULL, 2560264, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f981fff1000
 34 mprotect(0x7f9820061000, 2097152, PROT_NONE) = 0
 35 mmap(0x7f9820261000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x70000) = 0x7f9820261000
 36 close(3)                                = 0
 37 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
 38 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
 39 read(3, "177ELF2113>1P16"..., 832) = 832
 40 fstat(3, {st_mode=S_IFREG|0644, st_size=14560, ...}) = 0
 41 mmap(NULL, 2109712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f981fded000
 42 mprotect(0x7f981fdf0000, 2093056, PROT_NONE) = 0
 43 mmap(0x7f981ffef000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f981ffef000
 44 close(3)                                = 0
 45 access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
 46 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
 47 read(3, "177ELF2113>1000b"..., 832) = 832
 48 fstat(3, {st_mode=S_IFREG|0755, st_size=144976, ...}) = 0
 49 mmap(NULL, 2221184, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f981fbce000
 50 mprotect(0x7f981fbe8000, 2093056, PROT_NONE) = 0
 51 mmap(0x7f981fde7000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19000) = 0x7f981fde7000
 52 mmap(0x7f981fde9000, 13440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f981fde9000
 53 close(3)                                = 0
 54 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9820a76000
 55 arch_prctl(ARCH_SET_FS, 0x7f9820a77040) = 0
 56 mprotect(0x7f982064a000, 16384, PROT_READ) = 0
 57 mprotect(0x7f981fde7000, 4096, PROT_READ) = 0
 58 mprotect(0x7f981ffef000, 4096, PROT_READ) = 0
 59 mprotect(0x7f9820261000, 4096, PROT_READ) = 0
 60 mprotect(0x7f9820878000, 4096, PROT_READ) = 0
 61 mprotect(0x564cee735000, 4096, PROT_READ) = 0
 62 mprotect(0x7f9820aa3000, 4096, PROT_READ) = 0
 63 munmap(0x7f9820a7a000, 167308)          = 0
 64 set_tid_address(0x7f9820a77310)         = 313
 65 set_robust_list(0x7f9820a77320, 24)     = 0
 66 rt_sigaction(SIGRTMIN, {sa_handler=0x7f981fbd3cb0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f981fbe0890}, NULL, 8) = 0
 67 rt_sigaction(SIGRT_1, {sa_handler=0x7f981fbd3d50, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f981fbe0890}, NULL, 8) = 0
 68 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
 69 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
 70 statfs("/sys/fs/selinux", 0x7ffc909bbef0) = -1 ENOENT (No such file or directory)
 71 statfs("/selinux", 0x7ffc909bbef0)      = -1 ENOENT (No such file or directory)
 72 brk(NULL)                               = 0x564cef104000
 73 brk(0x564cef125000)                     = 0x564cef125000
 74 openat(AT_FDCWD, "/proc/filesystems", O_RDONLY|O_CLOEXEC) = 3
 75 fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
 76 read(3, "nodev	sysfs
nodev	rootfs
nodev	r"..., 1024) = 477
 77 read(3, "", 1024)                       = 0
 78 close(3)                                = 0
 79 access("/etc/selinux/config", F_OK)     = -1 ENOENT (No such file or directory)
 80 openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
 81 fstat(3, {st_mode=S_IFREG|0644, st_size=10281936, ...}) = 0
 82 mmap(NULL, 10281936, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f981f1ff000
 83 close(3)                                = 0
 84 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/charset.alias", O_RDONLY|O_NOFOLLOW) = -1 ENOENT (No such file or directory)
 85 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", O_RDONLY) = 3
 86 fstat(3, {st_mode=S_IFREG|0644, st_size=26376, ...}) = 0
 87 mmap(NULL, 26376, PROT_READ, MAP_SHARED, 3, 0) = 0x7f9820a9c000
 88 close(3)                                = 0
 89 futex(0x7f982064fa08, FUTEX_WAKE_PRIVATE, 2147483647) = 0
 90 openat(AT_FDCWD, "a.txt", O_RDONLY)     = 3
 91 ioctl(3, TCGETS, 0x7ffc909bbcf0)        = -1 ENOTTY (Inappropriate ioctl for device)
 92 fstat(3, {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
 93 umask(0700)                             = 022
 94 getpid()                                = 313
 95 openat(AT_FDCWD, "./sediSJ0Jh", O_RDWR|O_CREAT|O_EXCL, 0600) = 4
 96 umask(022)                              = 0700
 97 fcntl(4, F_GETFL)                       = 0x8002 (flags O_RDWR|O_LARGEFILE)
 98 fstat(3, {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
 99 read(3, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"..., 4096) = 3073
100 fstat(4, {st_mode=S_IFREG|000, st_size=0, ...}) = 0
101 write(4, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"..., 3069) = 3069
102 read(3, "", 4096)                       = 0
103 fchown(4, 1000, 1000)                   = 0
104 fchmod(4, 0100644)                      = 0
105 close(3)                                = 0
106 close(4)                                = 0
107 rename("./sediSJ0Jh", "a.txt")          = 0
108 close(1)                                = 0
109 close(2)                                = 0
110 exit_group(0)                           = ?
111 +++ exited with 0 +++

95行显示，打开了一个文件./sediSJ0Jh，fd为4

101行显示，对该fd进行了写操作

107行显示，对./sediSJ0Jh进行了重命名，为”a.txt“

vim 也执行了同样的类似的操作

查看执行前的inode

ls -i a.txt
12452049 a.txt

执行vim修改文件

strace -f -o vim.strace vim a.txt
# or
vim a.txt
VIMPID=`ps -ef |grep vim |grep -v grep |awk '{print $2}'`
sudo ltrace -p $VIMPID

查看执行结果

ls -i a.txt
12452058 a.txt

inode发生变化

  1 user@user-cloud-nuc1:~$ tail -n 100 vim.strace
  2 970   write(1, "w", 1)                  = 1
  3 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
  4 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
  5 970   write(1, "33[?25l33[34h33[?25h", 17) = 17
  6 970   select(1, [0], [], [0], {tv_sec=4, tv_usec=0}) = 1 (in [0], left {tv_sec=3, tv_usec=888987})
  7 970   read(0, "q", 4096)                = 1
  8 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
  9 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
 10 970   write(1, "q", 1)                  = 1
 11 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
 12 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
 13 970   write(1, "33[?25l33[34h33[?25h", 17) = 17
 14 970   select(1, [0], [], [0], {tv_sec=4, tv_usec=0}) = 1 (in [0], left {tv_sec=3, tv_usec=738309})
 15 970   read(0, "a", 4096)                = 1
 16 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
 17 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
 18 970   write(1, "a", 1)                  = 1
 19 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
 20 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
 21 970   write(1, "33[?25l33[34h33[?25h", 17) = 17
 22 970   select(1, [0], [], [0], {tv_sec=4, tv_usec=0}) = 1 (in [0], left {tv_sec=3, tv_usec=555370})
 23 970   read(0, "
", 4096)               = 1
 24 970   select(1, [0], [], [0], {tv_sec=0, tv_usec=0}) = 0 (Timeout)
 25 970   write(1, "
", 1)                 = 1
 26 970   stat("/home/user/a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
 27 970   access("/home/user/a.txt", W_OK)  = 0
 28 970   write(1, "33[?25l", 6)           = 6
 29 970   ioctl(0, TCGETS, {B38400 opost -isig -icanon -echo ...}) = 0
 30 970   ioctl(0, SNDCTL_TMR_START or TCSETS, {B38400 opost isig icanon echo ...}) = 0
 31 970   ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0
 32 970   getcwd("/home/user", 4096)        = 11
 33 970   write(1, ""a.txt"", 7)          = 7
 34 970   stat("a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
 35 970   access("a.txt", W_OK)             = 0
 36 970   getxattr("a.txt", "system.posix_acl_access", 0x7ffcd6162100, 132) = -1 ENODATA (No data available)
 37 970   stat("a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
 38 970   lstat("a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
 39 970   lstat("4913", 0x7ffcd61624c0)     = -1 ENOENT (No such file or directory)
 40 970   openat(AT_FDCWD, "4913", O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW, 0100644) = 3
 41 970   fchown(3, 1000, 1000)             = 0
 42 970   stat("4913", {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
 43 970   close(3)                          = 0
 44 970   unlink("4913")                    = 0
 45 970   stat("a.txt~", 0x7ffcd61621c0)    = -1 ENOENT (No such file or directory)
 46 970   stat("a.txt", {st_mode=S_IFREG|0644, st_size=3073, ...}) = 0
 47 970   stat("a.txt~", 0x7ffcd6161190)    = -1 ENOENT (No such file or directory)
 48 970   unlink("a.txt~")                  = -1 ENOENT (No such file or directory)
 49 970   rename("a.txt", "a.txt~")         = 0
 50 970   openat(AT_FDCWD, "a.txt", O_WRONLY|O_CREAT, 0644) = 3
 51 970   ftruncate(3, 0)                   = 0
 52 970   write(3, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"..., 3069) = 3069
 53 970   fsync(3)                          = 0
 54 970   stat("a.txt", {st_mode=S_IFREG|0644, st_size=3069, ...}) = 0
 55 970   stat("a.txt", {st_mode=S_IFREG|0644, st_size=3069, ...}) = 0
 56 970   fchmod(3, 0100644)                = 0
 57 970   close(3)                          = 0
 58 970   setxattr("a.txt", "system.posix_acl_access", "21637737737737744377377377377 4377377377377", 28, 0) = 0
 59 970   write(1, " 1L, 3069C written", 18) = 18
 60 970   lseek(4, 0, SEEK_SET)             = 0
 61 970   write(4, "b0VIM 8.020`372267^3212763123user"..., 4096) = 4096
 62 970   stat("/home/user/a.txt", {st_mode=S_IFREG|0644, st_size=3069, ...}) = 0
 63 970   unlink("a.txt~")                  = 0
 64 970   getcwd("/home/user", 4096)        = 11
 65 970   openat(AT_FDCWD, "/home/user/.viminfo", O_RDONLY) = 3
 66 970   stat("/home/user/.viminfo", {st_mode=S_IFREG|0600, st_size=22730, ...}) = 0
 67 970   getuid()                          = 1000
 68 970   getuid()                          = 1000
 69 970   stat("/home/user/.viminfo.tmp", 0x7ffcd6162540) = -1 ENOENT (No such file or directory)
 70 970   umask(000)                        = 002
 71 970   openat(AT_FDCWD, "/home/user/.viminfo.tmp", O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW, 0600) = 5
 72 970   umask(002)                        = 000
 73 970   fcntl(5, F_GETFL)                 = 0x28001 (flags O_WRONLY|O_LARGEFILE|O_NOFOLLOW)
 74 970   stat("/home/user/.viminfo.tmp", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
 75 970   fstat(3, {st_mode=S_IFREG|0600, st_size=22730, ...}) = 0
 76 970   read(3, "# This viminfo file was generate"..., 4096) = 4096
 77 970   read(3, "f\\>"
? \<name\>
|2,1,1562634451"..., 4096) = 4096
 78 970   read(3, "|4,39,2335,48,1589114505,"~/vim."..., 4096) = 4096
 79 970   read(3, "89114187,"~/vim.strace"
-'  975 "..., 4096) = 4096
 80 970   fstat(5, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
 81 970   write(5, "# This viminfo file was generate"..., 4096) = 4096
 82 970   write(5, "f\\>"
? \<name\>
|2,1,1562634451"..., 4096) = 4096
 83 970   write(5, "~/vim.strace
|4,39,2335,48,15891"..., 4096) = 4096
 84 970   read(3, "7095	0
	"	2487	0

> ~/dbtransfor"..., 4096) = 4096
 85 970   write(5, "4200,"~/vim.strace"
-'  1062  6 "..., 4096) = 4096
 86 970   read(3, "0
	+	86	11
	+	83	18
	+	86	0
	+	8"..., 4096) = 2250
 87 970   write(5, "5037	0
	"	79	0
	^	19	0
	.	76	0
	"..., 4096) = 4096
 88 970   read(3, "", 4096)                 = 0
 89 970   write(5, "84	7
	+	85	17
	+	39	34
	+	42	36
"..., 2176) = 2176
 90 970   close(5)                          = 0
 91 970   close(3)                          = 0
 92 970   stat("/home/user/.viminfo.tmp", {st_mode=S_IFREG|0600, st_size=22656, ...}) = 0
 93 970   stat("/home/user/.viminfo", {st_mode=S_IFREG|0600, st_size=22730, ...}) = 0
 94 970   unlink("/home/user/.viminfo")     = 0
 95 970   rename("/home/user/.viminfo.tmp", "/home/user/.viminfo") = 0
 96 970   write(1, "

33[?1l33>", 10) = 10
 97 970   write(1, "33[34h33[?25h33[?1049l", 19) = 19
 98 970   close(4)                          = 0
 99 970   unlink("/home/user/.a.txt.swp")   = 0
100 970   exit_group(0)                     = ?
101 970   +++ exited with 0 +++

49行显示，原文件被命名为a.txt~

50行显示，重新创建了一个名为a.txt的文件。

windows执行和inux类似的操作。

REF：

实际上，文件系统分析的文章网上一大堆。

北航操作系统 Operation System 七：文件系统

使用truss、strace或ltrace诊断软件的"疑难杂症"

Linux 内核中的 Device Mapper 机制

查看全文

相关阅读:
hdu 4786 Fibonacci Tree
Sae 上传文件到Storage
Java通过代理server上网
 iOS 利用Socket UDP协议广播机制的实现
 android_handler(三)
shell 脚本执行日志通用模块
 adt-bundle-linux-x86_64-20131030下新建project提示找不到adb和R.java问题的解决
 【MongoDB】The Access control of mongodb
Java——设计模式（装饰模式_IO）
动态顺序表

原文地址：https://www.cnblogs.com/shaohef/p/12863650.html