From owner-freebsd-questions  Mon Jun 24 16:11:13 1996
Return-Path: owner-questions
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.5/8.7.3) id QAA22439
          for questions-outgoing; Mon, 24 Jun 1996 16:11:13 -0700 (PDT)
Received: from phaeton.artisoft.com (phaeton.Artisoft.COM [198.17.250.211])
          by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id QAA22434
          for <questions@freefall.freebsd.org>; Mon, 24 Jun 1996 16:11:05 -0700 (PDT)
Received: (from terry@localhost) by phaeton.artisoft.com (8.6.11/8.6.9) id QAA02616; Mon, 24 Jun 1996 16:06:24 -0700
From: Terry Lambert <terry@lambert.org>
Message-Id: <199606242306.QAA02616@phaeton.artisoft.com>
Subject: Re: int link(const int inode, const char *name2)
To: garth@dogbert.systems.sa.gov.au (Garth T Kidd)
Date: Mon, 24 Jun 1996 16:06:23 -0700 (MST)
Cc: questions@freefall.freebsd.org
In-Reply-To: <1.5.4.32.19960625181506.00384450@dogbert.systems.sa.gov.au> from "Garth T Kidd" at Jun 25, 96 08:15:06 am
X-Mailer: ELM [version 2.4 PL24]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-questions@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

> [This is on a BSDI machine, but BSDI and FreeBSD are at least half-brothers,
> so here goes...]
> 
> I've accidentally unlinked a file (or rather, had it unlinked for me by gzip
> -- still my mistake) from the directory it was in.  The file is, however,
> still open.  If I can get the inode (downloading lsof now), is it possible
> to link it to the directory again?

Ghah.

You could manually mung the directory.

If you were root and manually munged the directory it used to live in
by using a binary editor on the block device (assuming it wasn't truncated
and nothing was created in its slot), then all you'd have to do is adjust
the end pointer:

Directory block containing file:

  Before the delete
  ,-------------------------.
  |                         v
,--------------------------.,------------------------.,---------
|   Good file              || Deleted file           || ...
`--------------------------'`------------------------'`---------
  |                                                   ^
  `---------------------------------------------------'
  After the delete

see /sys/ufs/ufs/dir.h, field is reclen.

It is easy to damage an FS this way.


					Terry Lambert
					terry@lambert.org
---
Any opinions in this posting are my own and not those of my present
or previous employers.