From owner-freebsd-questions@FreeBSD.ORG Tue Nov 11 12:31:34 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 33C9316A4CE for ; Tue, 11 Nov 2003 12:31:34 -0800 (PST) Received: from catseye.mine.nu (d154-5-164-0.bchsia.telus.net [154.5.164.0]) by mx1.FreeBSD.org (Postfix) with SMTP id 477B743F93 for ; Tue, 11 Nov 2003 12:31:33 -0800 (PST) (envelope-from catseye@catseye.mine.nu) Received: (qmail 1671 invoked by uid 1001); 11 Nov 2003 20:34:20 -0000 Date: Tue, 11 Nov 2003 12:34:20 -0800 From: Chris Pressey To: Lowell Gilbert Message-Id: <20031111123420.13afa9ca.cpressey@catseye.mine.nu> In-Reply-To: <44oevic0yc.fsf@be-well.ilk.org> References: <3FAEE02E.5040002@carmoda.com> <44oevic0yc.fsf@be-well.ilk.org> Organization: Cat's Eye Technologies X-Mailer: Sylpheed version 0.9.7 (GTK+ 1.2.10; i386-portbld-freebsd4.9) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit cc: freebsd.org@carmoda.com cc: freebsd-questions@freebsd.org Subject: Re: recovering data X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Nov 2003 20:31:34 -0000 On 11 Nov 2003 11:41:15 -0500 Lowell Gilbert wrote: > carmoda writes: > > > I would like to know if there is a proceedure i might be able to > > follow to recover a file that was deleted on a FreeBSD fileserver > > with SAMBA from a Windows 2000 workstation.. > > > > i know the file's name and i have powered down the server. > > The usual approach is to get it from your backups. > > The inode would help more than the filename, but you still might be > able to retrieve it if you are thoroughly knowledgeable in filesystem > internals. Since you're asking the question, I assume you're not. > You might look around for a tool that (if I recall correctly) is > called the Coroner's Toolkit. One trick I'm aware of, if you know some of the contents of the file, is to: - unmount the file system the file was on - grep through the raw device the file system was mounted on, looking for the known contents - copy those contents to a new file on another file system Some problems with this method are that the data isn't always stored contiguously (thus you may only be able to recover part of the file near the contents you know,) that the same contents might well occur in other files (possibly older versions of the same file that were deleted in the past), and that you're not likely to be aware of the contents of a binary file. However, I have used this method successfully to recover bits of program source code that I accidentally wiped out. -Chris