An Operating Systems Vade Mecum

210 File Structures Chapter 6file versions on different operating systems.Manual: A user who is about to modify a file first copies it to a new name andmodifies the file under the new name.Special utility: Some programs, particularly the text editor, copy the file they areabout to modify to a new name and modify the new file.General utility: When requested, a general utility program copies the file to a newname. A variant of this is a librarian program that allows files to be checked in andout. Checking in a file creates a new version of the file. Some librarian programssave space by storing only differences between successive versions. It is possible,although perhaps time consuming, to recover any version.Automatic: When a process opens a file for writing, the storage manager opens afresh copy of that file. The version number is part of the file name. If it is notmentioned when the file is opened, the most recent version is assumed. Tenex followsthis policy. Exec-8 is similar, but only a limited number of version numbersare available. Every time a new version is started, if the maximum number of versionsare already stored for the file, the oldest one is overwritten. Files under VMScan have up to about 32K versions, although the number can be restricted on adirectory or file basis.All these mechanisms provide for deleting the most recent version (usually the defaultdeletion operation), a particular version, a set of versions, or the entire file.4.3 Partial deletionAnother defense mechanism is partial deletion of files. The DeleteFile service callcould mark the file as deleted without reclaiming its storage on the disk. If the user laterdecides that the file should not have been deleted, an UndeleteFile service call couldchange the mark and place the file back into full service. Partially deleted files might becompletely deleted by a PurgeFile service call. Alternatively, they could be purged whenthe user’s session ends or when space is needed for other files. If the operating systemdoes not provide direct support for partially deleted files, the same effect can sometimesbe implemented by letting the ‘‘delete file’’ interactive command move the file to a directoryreserved for partially deleted files.One variant of the partial-deletion scheme is to structure files on the disk in such away that even though file deletion frees disk space, the file may still be reconstructeduntil that space is used, although possibly by a time-consuming process. A ‘‘recoverfile’’ program, which the user invokes in an emergency, tries to reconstruct the file if possiblefrom the remnants that still reside on the disk. We will see how physical file structurescan be chosen to meet this need.At the other extreme, VMS allows the user to specify that all the disk blocks containinga file be erased when it is destroyed, to prevent others from viewing sensitivedata.