Everyone says that you shouldn't do fsck to a disk without umount, because it will result in filesystem corruption.Actually I tried to fsck a mounted disk and the filesystem is corrupted.
That's few years ago when I didn't know much about Linux. But after all these years I still don't know what happened when doing fsck, and why this operation will corrupt the filesystem with disk mounted.
Waiting for a in-depth explanation :-)
fsck programming design makes an assumption that the program is the only thing accessing the file system. When the filesystem is mounted, it is being no doubt constantly changing thus violating the fsck design assumptions.
fsck does its work in several passes, fsck will have to read and correlate a lot of material concering filesystem structural integrity, if the filesystem is changing, the structural data is changing and fsck is not dynamic and will not track these changes. It will make "suggestions" as to what to fix based on its analysis at that pass not knowing that the structural data has changed. These changes could be just plain wrong! Fsck will then generate a corrupted filesystem.
