Date: Tue, 30 Apr 2002 00:16:47 +0100 From: Ian Dowse <iedowse@maths.tcd.ie> To: Joshua Steele <jsteele@CodefusionIS.com> Cc: Michael Sierchio <kudzu@tenebras.com>, freebsd-fs@freebsd.org Subject: Re: newfs overwrite... Message-ID: <200204300016.aa17293@salmon.maths.tcd.ie> In-Reply-To: Your message of "Mon, 29 Apr 2002 12:14:42 CDT." <20020429121106.V97112-100000@lilly>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <20020429121106.V97112-100000@lilly>, Joshua Steele writes: >Are there any other tools, etc. for freebsd that aide in rebuilding the fs >table? Or am i basically not going to be able to repair the drive, and >might as well move on and start salvaging what financial data i do have at >the current time before the tax quarter is up.... If the newfs was run with the same parameters as when the filesystem was originally created, then all of the top-level metadata will have been completely obliterated (used/free block lists, used/free inode lists, the inode structures themselves, and the top-level mapping between inodes and file blocks). This means that all of the records linking file names/types to file data blocks are gone. The data contained in the files is probably still intact, but it is scattered in block-sized chunks across the disk, interleaved with blocks from deleted files and anything else that has ever been written to the filesystem. About the only thing you can easily do to recover some fragments of text data is something like strings /dev/whatever | grep -100 'some string' where 'some string' is a text string contained in the data you want. If there are lots of files that begin with a known header (e.g. word documents), you might have some luck with a program that extracts N blocks after every block that has the right header at the start. There's a simple example at http://www.maths.tcd.ie/~iedowse/FreeBSD/docfind.pl but it is dumb and assumes that all office documents are 256k long word documents. Ian To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-fs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi? <200204300016.aa17293>