From owner-freebsd-fs@FreeBSD.ORG Sat Mar 26 14:53:41 2011 Return-Path: Delivered-To: freebsd-fs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 06BA41065677 for ; Sat, 26 Mar 2011 14:53:41 +0000 (UTC) (envelope-from pipatron@gmail.com) Received: from mail-gx0-f182.google.com (mail-gx0-f182.google.com [209.85.161.182]) by mx1.freebsd.org (Postfix) with ESMTP id B7A738FC16 for ; Sat, 26 Mar 2011 14:53:40 +0000 (UTC) Received: by gxk28 with SMTP id 28so871022gxk.13 for ; Sat, 26 Mar 2011 07:53:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:in-reply-to:references:date :message-id:subject:from:to:content-type; bh=wR8oTcf62bZTpZJ8wqxdtT3igSvWQjINXpYefhLI9g8=; b=m1SA8kZnoba6+6XlUPIvCzCaN7ZK5rZhzAzueipoCCkXPv+JxdtHgiTUo7LTVriHCH SvOC6M/uWcNgeSkeQpF7x0/UwMNbCnfLU5SRb/7IKGCJbT+nWjBqAWdTodRDdWMXfau8 cjySdUvWmWIR82YvRYOjwgWLP+xQqNT8a+Aho= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=WILYiBJsuSL/3Tp1hPUoERpMMROQ9Hsvwnu0OgFUArKShPyC8LsQ61g9cumTMeFf8t gJ+hpCprdLaS1Tj4tX4/UqTB9JrZjDdNOlvXnNr1ZeeSYEzla9rbrTUUWP7EfY/t8T8T fIA1TsjHriwnTXVs+hF3a26o3Klp0AAN5v8t0= MIME-Version: 1.0 Received: by 10.150.169.16 with SMTP id r16mr1372517ybe.335.1301149629261; Sat, 26 Mar 2011 07:27:09 -0700 (PDT) Received: by 10.147.35.6 with HTTP; Sat, 26 Mar 2011 07:27:09 -0700 (PDT) In-Reply-To: References: Date: Sat, 26 Mar 2011 15:27:09 +0100 Message-ID: From: Anders Andersson To: freebsd-fs@freebsd.org Content-Type: text/plain; charset=UTF-8 Subject: Re: Recover a ufs2 filesystem from a reformat with another ufs2 filesystem X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Mar 2011 14:53:41 -0000 Dear list! I realized that I never replied with a follow-up to this problem I had, and even though a long time have passed I want to explain what I did so that others in a similar situation can read about it. On Mon, Feb 14, 2011 at 1:35 AM, Ivan Voras wrote: > On 13/02/2011 21:39, Anders Andersson wrote: > >> 1) If an old file system is overwritten by a new file system with the >> same size, are there any traces of the old file system meta data left? >> I'm thinking randomized backup headers scattered throughout the file >> system, which would have a different location after each new format. > > No, not randomized at all, unfortunately for your purpose - there are copies > of superblocks, but all important data is on precisely deterministic > positions for somewhat the same reasons - to help recovery in case parts of > it are missing. Perhaps it would be beneficial if some of this information was spread out at random for recover purpose, although I don't know what bad side effects this would create. >> 4) If everything else fails, can you recommend a good overview about >> UFS2, how and where the bits and pieces are stored on disk? > > That would be a very complicated but also very interesting way to learn in > extreme details about a file system :) The more you learn, the better. :) I never went to this length though. I ended up just using photorec/magicrescue on the block device to find at least some photos and documents. > In any case, as others said, DO NOT WORK ON THE "LIVE" HARD DRIVE. Make a > copy image of it. Naturally. Though I had to do some extra trickery here since I didn't have 2TB spare to take a full backup. What I did was to use the device mapper subsystem in linux to create writable snapshots over the read-only master. Having multiple writable snapshots is handy when comparing things.