From nobody Tue Aug 9 12:23:57 2022 X-Original-To: freebsd-questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4M2C0y32JHz4Yq1l for ; Tue, 9 Aug 2022 12:24:02 +0000 (UTC) (envelope-from ftp51246-2575596@sh4-5.1blu.de) Received: from smh-06.1blu.de (smh-06.1blu.de [178.254.0.206]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4M2C0x3wdJz3mxB for ; Tue, 9 Aug 2022 12:24:01 +0000 (UTC) (envelope-from ftp51246-2575596@sh4-5.1blu.de) Received: from [172.16.29.5] (helo=sh4-5.1blu.de) by smh-06.1blu.de with esmtp (Exim 4.90_1) (envelope-from ) id 1oLOH7-0005ZD-IP for freebsd-questions@freebsd.org; Tue, 09 Aug 2022 14:23:57 +0200 Received: from localhost ([127.0.0.1]) by sh4-5.1blu.de with esmtp (Exim 4.90_1) (envelope-from ) id 1oLOH7-0005CX-Fi for freebsd-questions@freebsd.org; Tue, 09 Aug 2022 14:23:57 +0200 Date: Tue, 9 Aug 2022 14:23:57 +0200 From: Matthias Apitz To: freebsd-questions@freebsd.org Subject: What is the best way to look for a lost file in the disk blocks Message-ID: <20220809122357.GA17@sh4-5.1blu.de> Reply-To: Matthias Apitz Mail-Followup-To: freebsd-questions@freebsd.org List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit X-Operating-System: FreeBSD 12.0-CURRENT r314251 (amd64) X-message-flag: Mails containing HTML will not be read! Please send only plain text. User-Agent: Mutt/1.9.4 (2018-02-28) X-Rspamd-Queue-Id: 4M2C0x3wdJz3mxB X-Spamd-Bar: / Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=none (mx1.freebsd.org: domain of ftp51246-2575596@sh4-5.1blu.de has no SPF policy when checking 178.254.0.206) smtp.mailfrom=ftp51246-2575596@sh4-5.1blu.de X-Spamd-Result: default: False [0.20 / 15.00]; RBL_SENDERSCORE(2.00)[178.254.0.206:from]; AUTH_NA(1.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_LONG(-1.00)[-0.999]; NEURAL_HAM_SHORT(-1.00)[-0.999]; FORGED_SENDER(0.30)[guru@unixarea.de,ftp51246-2575596@sh4-5.1blu.de]; MIME_GOOD(-0.10)[text/plain]; ASN(0.00)[asn:42730, ipnet:178.254.0.0/19, country:DE]; MIME_TRACE(0.00)[0:+]; MLMMJ_DEST(0.00)[freebsd-questions@freebsd.org]; RCVD_IN_DNSWL_NONE(0.00)[178.254.0.206:from]; R_SPF_NA(0.00)[no SPF record]; R_DKIM_NA(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; FROM_NEQ_ENVFROM(0.00)[guru@unixarea.de,ftp51246-2575596@sh4-5.1blu.de]; FROM_HAS_DN(0.00)[]; REPLYTO_EQ_FROM(0.00)[]; ARC_NA(0.00)[]; RCVD_TLS_LAST(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; DMARC_NA(0.00)[unixarea.de]; TO_DN_NONE(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; HAS_REPLYTO(0.00)[guru@unixarea.de] X-ThisMailContainsUnwantedMimeParts: N Hello, Last night I damaged a plain UTF-8 HTML file (I copied by accident a JPEG file over it) and it turned out that the backup was done a month ago. I learned my lesson from this re/ doing backups more often of files I'm working on... Maybe there is a chance that the disk blocks are still not overwritten, what would be the best way to look for them block by block and if it contains certain string "foo-bar" having the block number from the beginning of the device to get it back with dd(1) into a file. Any scripts or tools for this? Thanks matthias -- Matthias Apitz, ✉ guru@unixarea.de, http://www.unixarea.de/ +49-176-38902045 Public GnuPG key: http://www.unixarea.de/key.pub