Date: Tue, 28 Oct 1997 08:30:45 +0100 From: Michael Schuster <Michael.Schuster@utimaco.co.at> To: "hackers@FreeBSD.ORG" <hackers@FreeBSD.ORG> Subject: Re: Recovering Lost Inode? Message-ID: <345594A5.F3E0C8BA@utimaco.co.at>
next in thread | raw e-mail | index | archive | help
James Buszard-Welcher <james@reef.com> wrote: >... (we now enter the theoretical zone) > *could* I have been able to use somekindof Norton's Utilities-esque > package for UNIX which could check inodes and look for ones that > were 'file starters', and maybe check the that if all of the inodes > pointed to by that starter inode (it was big file so I excect > a level or two of inode redirection) were still intact it could > pull it back? Kinda like an 'un-delete' fsck? Ever hear of > such a thing? >From my scanty knowledge of Unix File systems, there's a slight correction necessary here: Any inode is "starter" inode; what's referred to by the indirect pointers (sorry if the name isn't the correct one) are data blocks containing pointers to data blocks which in turn contain either "real" data or again pointers to other data blocks (depending on whether they're pointed at by single, double or triple [are they used in FreeBSD?] redirection pointers in the inode); they don't contain any inode specific things (like permission bits, etc.). Another thing: inodes are reused as soon as they are freed (I don't know by what policy - any pointers where to look?). So finding an "intact" inode needn't mean that that's the file you need. Interpreting arbitrary free data blocks as "pointed to by indirection pointers" in order to reconstruct a deleted file is probably a very hard problem. Putting aside the high probability that one of the file blocks (not the inode) will be reused as soon as the file is rm'ed (you're in a multitasking environment, remember), the question remains whether freed data blocks are cleared or, in the case of inodes, marked as freed/unused (they're in a list of freed inodes, aren't they?). So, back to your question: you could alias/rewrite /bin/rm to mv your file to /saved/files/here and have a cron script deleting files in there older than a week, e.g. Just my 2 bits. Any corrections/updates/etc. very welcome!! Michael -- Michael Schuster Utimaco Safe Concept GmbH. | Tel: +43 732 655755 41 Europaplatz 6 | Fax: +43 732 655755 5 A-4020 Linz Austria | email: Michael.Schuster@utimaco.co.at
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?345594A5.F3E0C8BA>