From owner-freebsd-fs@FreeBSD.ORG Thu Feb 6 13:20:34 2014 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B337D465 for ; Thu, 6 Feb 2014 13:20:34 +0000 (UTC) Received: from mail-wi0-x22f.google.com (mail-wi0-x22f.google.com [IPv6:2a00:1450:400c:c05::22f]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4E0381464 for ; Thu, 6 Feb 2014 13:20:34 +0000 (UTC) Received: by mail-wi0-f175.google.com with SMTP id hm4so1592487wib.8 for ; Thu, 06 Feb 2014 05:20:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=piRZ6Q7Dae9liUbtZFOoERV62dzT/zWIEUvBFvKgpbk=; b=VyNHdTlXaa/FWIwTEqA12R2g26On09R3SUCPMq09MQ+eArXkk7SiYMOHrkeqM7/7hJ hG+AzBUT0NS8j+7jTuRTCP5/eg53XoqbktllUTKhxoVBfMEKs7eJxw24UfVyozwXcSSV 4RfVpotzswkwyujCFECEG/Ep5KZMlQsN772wnUjtqSB3lp6zTSzCrKnCk12nhaBKIkVD GjS9+qjudJ2BT/IToOW/ZxoIGpg6g3yGGvIswNmfajyh9Phorf6OhjXd5lLKTY1irtZN TxxGZO8diLJ/Tn7bEVtTrZyhuw3DDMlhNLy0xnF3N/hA+ThxBfFMP0mqT2QC3Oq3FmsO jlPA== MIME-Version: 1.0 X-Received: by 10.194.119.168 with SMTP id kv8mr1946501wjb.41.1391692832604; Thu, 06 Feb 2014 05:20:32 -0800 (PST) Received: by 10.194.60.17 with HTTP; Thu, 6 Feb 2014 05:20:32 -0800 (PST) Date: Thu, 6 Feb 2014 08:20:32 -0500 Message-ID: Subject: Recovering deleted file, strange structure From: Felipe Monteiro de Carvalho To: freebsd-fs@freebsd.org Content-Type: text/plain; charset=UTF-8 X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Feb 2014 13:20:34 -0000 Hello, I am implementing a software to recover deleted files in UFS-1/2. Right now I am first focusing in UFS-2, so I created a partition, added some files, deleted a file, and then added more files. The name of the file (10MB_88.bin) completely vanished from the disk image, and it's inode and dir entry were also overwritten. But I found this strange place in the disk where I can clearly see references to the first and following block fragments of the disk ($B0 12 00 00 00 00 00 00), see this screenshot here: http://imageshack.com/a/img546/3399/o1lz.png But what kind of section/structure is this? I am reading the source code of FreeBSD UFS driver, and I attempted to compare to the structs there, but nothing seams to match ... each $20 bytes we have a new record with a reference to a block fragment. I tried to compare to the ufs_cylinder_group but it doesn't match ... so any ideas which struct / place in the source code is utilized to create this structure? thank you very much =) -- Felipe Monteiro de Carvalho