Date: Sat, 01 Aug 1998 00:47:41 +0100 (BST) From: Duncan Barclay <dmlb@ragnet.demon.co.uk> To: (Patrick Hartling) <mystify@wkstn4-208.lxr.georgetown.edu> Cc: freebsd-fs@FreeBSD.ORG Subject: Re: Trying to recover lost file Message-ID: <XFMail.980801004741.dmlb@computer.my.domain> In-Reply-To: <199807312116.OAA29689@usr09.primenet.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 31-Jul-98 Terry Lambert wrote: >> Last night, I did something phenomenally dumb and, to make a long story >> short, lost everything changed in my home directory between June 19 and >> last night. It was all in a tar file on a Jaz disk, and instead of >> restoring >> it, I removed it. :( I realize this is a very tall order, but is there >> anything I can do to get the file back? I realize that the general >> principle >> is that "once it's gone, it's gone," but I am very willing to spend hours, >> days, weeks, etc. trying to get this tar file back. It contains, among many >> other things, work I've done for my graduate research that I'd really rather >> not try to do over again if I can avoid it (even if it means spending more >> time trying to get it back than it took to do it in the first place). >> >> So, here's my situation. The file system on the Jaz disk has not been >> modified since I removed the tar file. I dd'd the entire file system to a >> file just to be safe. Running more(1) on that file shows that at least the >> file name of the deleted file is still in the file system in some form. A >> friend pointed me at fsdb(8), and I did an experiment with /usr/obj wherein >> I >> dd'd /dev/zero to a file for a couple of seconds, figured out which inode >> that >> file was at, removed it, then went to that inode to see what information was >> there. Everything looked the same, so now I am wondering what, if anything, >> can be done to "restore" that file? My file system skills and knowledge are >> poor at best, and some of what I've said here may sound ridiculous, but I am >> desperate enough to go through all 126,000+ inodes until I find something >> that looks vaguely like what I'm looking for (thank goodness for >> libedit(3)!). > > Please tell me you were mounted sync, and tell me you didn't create any > files on the drive after you did this! > > > The first thing to do is to find the inode of the file that was deleted. It won't help... Terry a big problem under FreeBSD is that it hoses the inode pretty quickly. I know, I did the same thing to a chapter of my PhD thesis a year or so ago. Found the inode as you described and it was all 0... > > Unfortunately, all the tools I cobbled together to do this the last > time I shot my foot off are on 6525 QIC tape, and they apply to the > UFS in SunOS 4.1.3u1, and don't know anything about indirect blocks > using negative offsets, etc.. Strange I've got a set too, but now they work on FreeBSD! >From what I remember SunOs doesn't zero the inode out. (I've mailed a copy to Patrick) Now I have RCS/CVS everywhere. Duncan --- ________________________________________________________________________ Duncan Barclay | God smiles upon the little children, dmlb@ragnet.demon.co.uk | the alcoholics, and the permanently stoned. ________________________________________________________________________ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-fs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?XFMail.980801004741.dmlb>