From owner-freebsd-fs Fri Jul 31 16:51:20 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id QAA26974 for freebsd-fs-outgoing; Fri, 31 Jul 1998 16:51:20 -0700 (PDT) (envelope-from owner-freebsd-fs@FreeBSD.ORG) Received: from post.mail.demon.net (post-11.mail.demon.net [194.217.242.40]) by hub.freebsd.org (8.8.8/8.8.8) with SMTP id QAA26961 for ; Fri, 31 Jul 1998 16:51:17 -0700 (PDT) (envelope-from dmlb@ragnet.demon.co.uk) Received: from (ragnet.demon.co.uk) [158.152.46.40] by post.mail.demon.net with smtp (Exim 1.82 #2) id 0z2Owu-0007gk-00; Fri, 31 Jul 1998 23:51:00 +0000 Received: from dmlb by ragnet.demon.co.uk with local (Exim 1.82 #1) id 0z2Oth-0000fv-00; Sat, 1 Aug 1998 00:47:41 +0100 Message-ID: X-Mailer: XFMail 1.2 [p0] on FreeBSD X-Priority: 3 (Normal) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <199807312116.OAA29689@usr09.primenet.com> Date: Sat, 01 Aug 1998 00:47:41 +0100 (BST) From: Duncan Barclay To: (Patrick Hartling) Subject: Re: Trying to recover lost file Cc: freebsd-fs@FreeBSD.ORG Sender: owner-freebsd-fs@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On 31-Jul-98 Terry Lambert wrote: >> Last night, I did something phenomenally dumb and, to make a long story >> short, lost everything changed in my home directory between June 19 and >> last night. It was all in a tar file on a Jaz disk, and instead of >> restoring >> it, I removed it. :( I realize this is a very tall order, but is there >> anything I can do to get the file back? I realize that the general >> principle >> is that "once it's gone, it's gone," but I am very willing to spend hours, >> days, weeks, etc. trying to get this tar file back. It contains, among many >> other things, work I've done for my graduate research that I'd really rather >> not try to do over again if I can avoid it (even if it means spending more >> time trying to get it back than it took to do it in the first place). >> >> So, here's my situation. The file system on the Jaz disk has not been >> modified since I removed the tar file. I dd'd the entire file system to a >> file just to be safe. Running more(1) on that file shows that at least the >> file name of the deleted file is still in the file system in some form. A >> friend pointed me at fsdb(8), and I did an experiment with /usr/obj wherein >> I >> dd'd /dev/zero to a file for a couple of seconds, figured out which inode >> that >> file was at, removed it, then went to that inode to see what information was >> there. Everything looked the same, so now I am wondering what, if anything, >> can be done to "restore" that file? My file system skills and knowledge are >> poor at best, and some of what I've said here may sound ridiculous, but I am >> desperate enough to go through all 126,000+ inodes until I find something >> that looks vaguely like what I'm looking for (thank goodness for >> libedit(3)!). > > Please tell me you were mounted sync, and tell me you didn't create any > files on the drive after you did this! > > > The first thing to do is to find the inode of the file that was deleted. It won't help... Terry a big problem under FreeBSD is that it hoses the inode pretty quickly. I know, I did the same thing to a chapter of my PhD thesis a year or so ago. Found the inode as you described and it was all 0... > > Unfortunately, all the tools I cobbled together to do this the last > time I shot my foot off are on 6525 QIC tape, and they apply to the > UFS in SunOS 4.1.3u1, and don't know anything about indirect blocks > using negative offsets, etc.. Strange I've got a set too, but now they work on FreeBSD! >From what I remember SunOs doesn't zero the inode out. (I've mailed a copy to Patrick) Now I have RCS/CVS everywhere. Duncan --- ________________________________________________________________________ Duncan Barclay | God smiles upon the little children, dmlb@ragnet.demon.co.uk | the alcoholics, and the permanently stoned. ________________________________________________________________________ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-fs" in the body of the message