From nobody Wed Aug 10 05:18:03 2022 X-Original-To: questions@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4M2dWD3CCcz4YLdp for ; Wed, 10 Aug 2022 05:18:16 +0000 (UTC) (envelope-from michaelsprivate@gmail.com) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4M2dWC4lRYz3bFy for ; Wed, 10 Aug 2022 05:18:15 +0000 (UTC) (envelope-from michaelsprivate@gmail.com) Received: by mail-io1-xd2f.google.com with SMTP id z145so11305209iof.9 for ; Tue, 09 Aug 2022 22:18:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc; bh=60VDOg34Eky027GW47d1lwtAghp1pOmKumOZyXej1BM=; b=QD7NJoExtj4mpZPG4Vg9elGkiMY9ZdUiYY40U4oxFlUlhHbxbmyCEcsTIrOJAL1D3y jv7D72TkFBsjMNFgLC0JPFRu91xar5kdP5ApTORugwJ23K0GwWqlRMFltqJIMd5lBsqc iX+xe9BXXpsTDyHhN94+sB8K1reuovwrybibxiLLKJe2mfo1EA+Iikt3VH6PDiOpvs1b tJiOUQJ7UObTgq/OV6++0ydh9Ssl881cP44AD4aeAIBy0VEkdcnxBtXOgOJMxrg/UuCm Nhn4Nc+L7VbdeEmg6wJAzBxRaAAzAbs9xtISpNkBvAOehULjq+HC60zJMBlukuPgbMtC Kmmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc; bh=60VDOg34Eky027GW47d1lwtAghp1pOmKumOZyXej1BM=; b=22mfzPMTL5YHfVizh5wNwuXFhR3d8IxGAqvRTT2zhdY61Wu4Mj6JA+PYuZOSCY6rgt vz4QDH8T9sEPOJANxUiqLfxtfYPCWRFycBnWPPOP8Rz23SrkSPfVKItEquRIbkh2+DbO YFvFSuK6NZue0JiuzFl28DTPYCNaDE89TE4CHXGDnhZE13Y1ikBPH+LGHxDlBjnlKIQG ajCBzT3SQi6cELeKITkiNmXXNfr7wfUxKRd9/2esp1RGlAsvRucHBbzWuyiBIpaVD3IQ Nk6haWTsbnSkcHXr8sIuYW6HBWBBaY5xYuPkVZmEZv5fM9OIfn4ax2/kwSPul57RXO1e oulA== X-Gm-Message-State: ACgBeo0W9XdGjBEoTA/Bk6I70jfdh6Sse0xoB258mGUjhDSvT2mmfj2/ Y7+gWlVZXm/2UpTNm894NJlECpKfOnw1V1s8mPNRpf20Dc1bHQ== X-Google-Smtp-Source: AA6agR4mUDIGctFeVypawmjqbuQ+INh3yCrPUewPFsMQ4+65AdHlWpyPojB2JdkxdFWkL8FkCrLJPTGD3aNwTcfPpp0= X-Received: by 2002:a02:b10c:0:b0:342:6c6a:eb4e with SMTP id r12-20020a02b10c000000b003426c6aeb4emr12244772jah.172.1660108694593; Tue, 09 Aug 2022 22:18:14 -0700 (PDT) List-Id: User questions List-Archive: https://lists.freebsd.org/archives/freebsd-questions List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org MIME-Version: 1.0 References: <20220809122357.GA17@sh4-5.1blu.de> <448ac676-5acd-02b2-00c6-5ae0c6773438@holgerdanske.com> In-Reply-To: <448ac676-5acd-02b2-00c6-5ae0c6773438@holgerdanske.com> From: Michael Schuster Date: Wed, 10 Aug 2022 07:18:03 +0200 Message-ID: Subject: Re: What is the best way to look for a lost file in the disk blocks To: David Christensen Cc: questions Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 4M2dWC4lRYz3bFy X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20210112 header.b=QD7NJoEx; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of michaelsprivate@gmail.com designates 2607:f8b0:4864:20::d2f as permitted sender) smtp.mailfrom=michaelsprivate@gmail.com X-Spamd-Result: default: False [-3.95 / 15.00]; NEURAL_HAM_LONG(-1.00)[-0.995]; NEURAL_HAM_SHORT(-0.99)[-0.995]; NEURAL_HAM_MEDIUM(-0.96)[-0.956]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36:c]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20210112]; MIME_GOOD(-0.10)[text/plain]; MLMMJ_DEST(0.00)[questions@freebsd.org]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; MID_RHS_MATCH_FROMTLD(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; ARC_NA(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; RCVD_TLS_LAST(0.00)[]; FREEMAIL_FROM(0.00)[gmail.com]; FROM_HAS_DN(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::d2f:from]; PREVIOUSLY_DELIVERED(0.00)[questions@freebsd.org]; TO_DN_ALL(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim] X-ThisMailContainsUnwantedMimeParts: N On Wed, Aug 10, 2022 at 3:55 AM David Christensen wrote: > > On 8/9/22 05:23, Matthias Apitz wrote: > > > > Hello, > > > > Last night I damaged a plain UTF-8 HTML file (I copied by accident a > > JPEG file over it) and it turned out that the backup was done a month > > ago. I learned my lesson from this re/ doing backups more often of files > > I'm working on... > > Maybe there is a chance that the disk blocks are still not overwritten, > > what would be the best way to look for them block by block and if it > > contains certain string "foo-bar" having the block number from the > > beginning of the device to get it back with dd(1) into a file. Any > > scripts or tools for this? if this is UFS, IME you're out of luck, as overwrite really means overwrite (but perhaps things have progressed more since I had any detailed dealings with UFS). If this is ZFS, ZFS's copy-on-write semantics may get you lucky ... I once searched for and used a tool that scans a complete (unmounted!) disk and produces "most likely" files - that was FAT though, don't know if such tools exist for other file systems. I'm afraid I don't have the name of the tool handy. HTH Michael > > > You might be able to find raw blocks with grep(1) and/or Perl: > > https://unix.stackexchange.com/a/710673 > > > But, I do not know how UFS chains together blocks to form a file. > > > David > > > p.s. If you put your development directory on ZFS, you can use > zfs-auto-snapshot to take snapshots on whatever schedule you want. > -- Michael Schuster http://recursiveramblings.wordpress.com/ recursion, n: see 'recursion'