Date: Fri, 12 Feb 1999 23:31:26 +0000 (GMT) From: Terry Lambert <tlambert@primenet.com> To: sec@pi.musin.de (Stefan `Sec` Zehl) Cc: freebsd-hackers@FreeBSD.ORG Subject: Re: data recovery ? Message-ID: <199902122331.QAA25413@usr01.primenet.com> In-Reply-To: <19990211141454.A23872@yoda.pi.musin.de> from "Stefan `Sec` Zehl" at Feb 11, 99 02:14:54 pm
next in thread | previous in thread | raw e-mail | index | archive | help
> A friend of mine (no, not me :-) just managed to do a fresh 3.0 install > on his box without saving his previous data to another box. > He had one home.tar lying in /usr before he re-paritioned and > reinstalled. > > Is there _any_ way to recover it now? Unfortunately nobody here has > enough knowledge of the filesystem structure for ufs. > > Are there any pointers on what we can try to recover this .tar now, or > are we lot ? If you haven't done anything else to the disk since doing this, and the home.tar was truly a home.tar and not compressed, then the contents should be plaintext. In general, if you didn't change the offset of the start, or you changed it in a 4M increment, then you don't have to worry about cylinder group data having squatted on your file. You may have inode data, or other data that has eaten holes in the home directory. Any binary files you had are goners. Write them off now. For text files, you can read the disk for recognizable chunks of the text. They will most likely be in <FS block size> to 9 times <FS block size> runs of data (to account for clustering). I've often thought that tar should ftruncate/fcntl files larger by the run of the file it was about to archive plus metadata, in order to promote clustering of archives. I once recovered 6 weeks of work on a Motif clone this way; it's time consuming, but you can do it. You will probably need to write some dumb little raw device grep and ofset cluster grabbing tools; I tend to rewrite these each time I have to recover data, since they're no more than 30 or so lines of code each, so I don't have them to send to you. If you find the task onerous, be sure to submit them as ports so that they can become widely available. Terry Lambert terry@lambert.org --- Any opinions in this posting are my own and not those of my present or previous employers. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199902122331.QAA25413>