Date: Thu, 30 Dec 1999 17:00:15 -0500 (EST) From: "Crist J. Clark" <cjc@cc942873-a.ewndsr1.nj.home.com> To: freebsd-questions@freebsd.org Cc: cjclark@home.com Subject: Re: Recovering "Deleted" File Message-ID: <199912302200.RAA87172@cc942873-a.ewndsr1.nj.home.com> In-Reply-To: <199912302048.VAA18244@dorifer.heim3.tu-clausthal.de> from Oliver Fromme at "Dec 30, 1999 09:48:41 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
Oliver Fromme wrote, [Charset ISO-8859-1 unsupported, filtering to ASCII...] > (Posted and mailed according to ``Reply-To''.) > > Crist J. Clark wrote in list.freebsd-questions: > > First off, I realize that once 'rm'ed a file is pretty much > > unrecoverable on a UFS. However, this is a special case. A file has > > been 'rm'ed, but there is a program that still has that file 'opened.' > > > > IIRC, a file in this state is recoverable since it actually still > > physically exists, and I also know the inode (from fstat(1) > > output). So, uhh... How do I actually go about doing such a thing? > > You are right. As long as at least one process keeps the file > opened, it's data does exist on the disk. The problem is that > there is no directory entry anymore that references the inode. > > You can recover this with the ``fsdb'' tool. However, be VERY > careful. You can destroy the filesystem with fsdb if you're > doing the wrong things. I'd recommend that you read the manual > page of fsdb carefully. > > Having that said, recovering a reference to an existing inode > is easy if you know the inode number. Just change to any > directory on the filesystem which contains the inode, then > type (at the fsdb prompt): ``ln 42 foobar'', where 42 is the > inode number, and foobar is the name of the entry that shall be > created in the current directory as a reference for that inode. > then exit fsdb. That's it. > > You might want to do an fsck afterwards, just to be sure that > everything is alright, but it shouldn't be necessary. I forgot to mention this in my initial mail, but I think there should be a very "safe" way to do all of this. There really is no reason to save the exact same bits that are there now on the disk. I'd be perfectly happy to just copy the "deleted" file into a fresh new file, then let the old one disappear when I close the program. This reduces the problem to simply being able to open a FILE stream or file descriptor from just knowing the inode... which I am not familiar with doing and have not been able to track down in the manpages (even after having fsdb(8) pointed out to me). Thanks for the help so far. -- Crist J. Clark cjclark@home.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199912302200.RAA87172>