Cybersecurity

From further readings and own understanding almost all NIX file systems doesn't store filenames in i-node. Many people seem saying that file names are not recoverable when restoring an i-node. I am a confused.

What I understood is when recovering the i-node one have a chance to recover MAC-timestamps and the i-node number. If there was a process using the i-node number then there is a backup of the file somewhere in the O.S. sub directories (related to the device number)

Coronn688 may be there is a NIX flavor you are aware about that keep filenames in the i-node?

thank you anyway

Oh, yes -- this is because of the way files can exist in multiple places on a UNIX filesystem, via hardlinks. It's effectively the exact same file but in multiple places (though they must all be on the same partition). Attributes in the inode(user, group, size, atime, mtime, and so forth) are all shared. Which means name plainly can't be in the inode.

They probably put it in the directory entry instead.

As you've been told many times by now, how the filesystem is laid out depends on what system and what filesystem is being used. If you're curious about an
"average" one, I suggest looking at the structures of the linux ext2 filesystem. (which definitely keeps the name in the directory entry.)

As far as I am aware, filenames are not stored in an inode table but in each directory.

Yes, my mistake. I gave too quick an answer.