Thanks to Carl and Jim for replying, So far though I haven't yet got the answer I require. I know what happens when a file is deleted. What I need to know is what steps occur in Ext2 specifically.
Well, I thought Carl's hook into the source was pretty good.
Assuming the "ext2_" prefix to function calls ...
From fs/ext2/namei.c :-
unlink checks that it can find_entry, then calls delete_entry and dec_count(inode)
dec_count decrements inode->i_nlink, then calls mark_inode_dirty
mark_inode_dirty lives in fs/inode.c, and puts the inode into the superblocks dirty list.
The trail isn't as easy to follow after that, but at some point there is a sync call, into sync_inodes to sync_inodes_sb, which calls sync_list repeatedly on the dirty list.
sync_list goes to __sync_one, which will "not rewrite" the inode if it was set dirty with no other attribute, so I suppose that's functionally the same as dropping it. Then I lose the trail.
The code isn't too hard to read, I'm not a C programmer by any stretch of imagination. I guess it all hinges on why you need to know. If you're trying to write your own ext2 driver, then you should have already read the code. If you're trying to find out if you can undelete a file, then you need to have unmounted the damaged filesystem and started to poke around disk sectors manually. Try the Linux Kernel Hackers Guide http://en.tldp.org/LDP/khg/HyperNews/get/khg.html for more leads.
-jim
