From owner-freebsd-fs@FreeBSD.ORG Mon Feb 14 00:36:01 2011 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 48F4C106566B for ; Mon, 14 Feb 2011 00:36:01 +0000 (UTC) (envelope-from freebsd-fs@m.gmane.org) Received: from lo.gmane.org (lo.gmane.org [80.91.229.12]) by mx1.freebsd.org (Postfix) with ESMTP id C70F68FC16 for ; Mon, 14 Feb 2011 00:36:00 +0000 (UTC) Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from ) id 1PomQ3-0000Xn-Ls for freebsd-fs@freebsd.org; Mon, 14 Feb 2011 01:35:59 +0100 Received: from cpe-188-129-78-62.dynamic.amis.hr ([188.129.78.62]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 14 Feb 2011 01:35:59 +0100 Received: from ivoras by cpe-188-129-78-62.dynamic.amis.hr with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Mon, 14 Feb 2011 01:35:59 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: freebsd-fs@freebsd.org From: Ivan Voras Date: Mon, 14 Feb 2011 01:35:44 +0100 Lines: 52 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: usenet@dough.gmane.org X-Gmane-NNTP-Posting-Host: cpe-188-129-78-62.dynamic.amis.hr User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US; rv:1.9.2.12) Gecko/20101102 Thunderbird/3.1.6 In-Reply-To: Subject: Re: Recover a ufs2 filesystem from a reformat with another ufs2 filesystem X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Feb 2011 00:36:01 -0000 On 13/02/2011 21:39, Anders Andersson wrote: > 1) If an old file system is overwritten by a new file system with the > same size, are there any traces of the old file system meta data left? > I'm thinking randomized backup headers scattered throughout the file > system, which would have a different location after each new format. No, not randomized at all, unfortunately for your purpose - there are copies of superblocks, but all important data is on precisely deterministic positions for somewhat the same reasons - to help recovery in case parts of it are missing. > 2) If there are no traces left of the old file system, would there be > any UFS2-aware recovery programs that could scan the disk and try to > regenerate the necessary meta data from, say, partition size, file > offsets, some other magic...? Yes, there are tools which scan the entire drive / partition and try to identify blocks which look like directories and files, but then you need to recover inodes. Fortunately, not all inodes are pre-initializes in UFS2, some may be salvagable. In any case, I don't predict much success. The process would use some of the same tools like "undeleting" files, see * http://www.google.com/search?q=freebsd+undelete * http://www.google.com/search?q=freebsd+recover+filesystem (it's been a long time I tried something similar, I don't know which tools I used). > 3) Are there any powerful tools availaible for tasks like this in > FreeBSD that are not ported to Linux? In that case, I could easily > install FreeBSD in a virtual machine and salvage the files there. Not likely. > 4) If everything else fails, can you recommend a good overview about > UFS2, how and where the bits and pieces are stored on disk? That would be a very complicated but also very interesting way to learn in extreme details about a file system :) I don't know of any online description of UFS2 (note: "UFS" systems are slightly different in all BSDs and very different in Solaris) except the sources but if you can find this book it will probably help you get started quickly: http://www.amazon.com/Design-Implementation-FreeBSD-Operating-System/dp/0201702452 In any case, as others said, DO NOT WORK ON THE "LIVE" HARD DRIVE. Make a copy image of it.