Date: Thu, 30 Dec 1999 21:48:41 +0100 (CET) From: Oliver Fromme <olli@dorifer.heim3.tu-clausthal.de> To: cjclark@home.com Cc: freebsd-questions@freebsd.org Subject: Re: Recovering "Deleted" File Message-ID: <199912302048.VAA18244@dorifer.heim3.tu-clausthal.de>
next in thread | raw e-mail | index | archive | help
(Posted and mailed according to ``Reply-To''.)
Crist J. Clark wrote in list.freebsd-questions:
> First off, I realize that once 'rm'ed a file is pretty much
> unrecoverable on a UFS. However, this is a special case. A file has
> been 'rm'ed, but there is a program that still has that file 'opened.'
>
> IIRC, a file in this state is recoverable since it actually still
> physically exists, and I also know the inode (from fstat(1)
> output). So, uhh... How do I actually go about doing such a thing?
You are right. As long as at least one process keeps the file
opened, it's data does exist on the disk. The problem is that
there is no directory entry anymore that references the inode.
You can recover this with the ``fsdb'' tool. However, be VERY
careful. You can destroy the filesystem with fsdb if you're
doing the wrong things. I'd recommend that you read the manual
page of fsdb carefully.
Having that said, recovering a reference to an existing inode
is easy if you know the inode number. Just change to any
directory on the filesystem which contains the inode, then
type (at the fsdb prompt): ``ln 42 foobar'', where 42 is the
inode number, and foobar is the name of the entry that shall be
created in the current directory as a reference for that inode.
then exit fsdb. That's it.
You might want to do an fsck afterwards, just to be sure that
everything is alright, but it shouldn't be necessary.
Regards
Oliver
--
Oliver Fromme, Leibnizstr. 18/61, 38678 Clausthal, Germany
(Info: finger userinfo:olli@dorifer.heim3.tu-clausthal.de)
"In jedem Stück Kohle wartet ein Diamant auf seine Geburt"
(Terry Pratchett)
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199912302048.VAA18244>