Date: Sun, 27 Jul 1997 16:10:15 -0500 (CDT) From: Dave Bodenstab <imdave@mcs.net> To: mc4469@mclink.it Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Undelete a file, how ? Message-ID: <199707272110.QAA27805@imdave.pr.mcs.net>
next in thread | raw e-mail | index | archive | help
> > > Hi all. > > > > Is there a way to undelete a file under FreeBSD 2.2.1 ? > > > > Regards. > > Yes, its called a backup. :) > This answer is correct. However, if you act fast, and the file is important enough to justify this extremely labor intensive method, the following has worked for me. Immediately cease any activity that would cause further writes to the file system containing the deleted file. The best solution is to unmount the file system. I used dd and GNU's split to copy the raw data, in fairly easily managed chunks -- say 100K each, from the slice (/dev/rwds... or /dev/rsd...) to a scratch area. Obviously, the scratch area needs to be larger than the original file system, or you'll have to do this a section at a time. Then, using GNU's fgrep (I don't know if the stock fgrep will handle files containing mucho binary data) I look for a string that I know was in the file in question. This assumes that we're dealing with a text file... a binary file would be next to impossible to deal with. This identifies the chunks of the original file system that may contain the data from the deleted file. Next, using an editor (I use vim) I edit the likely chunks, search for the data, and reconstruct the contents of the deleted file. I have successfully used this to recover the contents of a file that I had spent much time just editing, and then deleted it ;-( Another possible solution would be to read the source and determine what happens when a file is deleted from the file system type in question. Long ago, using system 5's file system type, it was possible to recover a file because the file's blocks were added to the free list in a predictable way. If nothing wrote to the drive after a file was deleted, the file could be recovered if one acted quickly. Dave Bodenstab imdave@mcs.net
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199707272110.QAA27805>