From owner-freebsd-questions@FreeBSD.ORG  Thu Mar 17 18:24:11 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9288C16A4CE
	for <freebsd-questions@freebsd.org>;
	Thu, 17 Mar 2005 18:24:11 +0000 (GMT)
Received: from puffer.spinthread.com (puffer.spinthread.com [209.31.146.91])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2FD3343D39
	for <freebsd-questions@freebsd.org>;
	Thu, 17 Mar 2005 18:24:11 +0000 (GMT)	(envelope-from yanek@mail.com)
Received: from mail.spinthread.com (avenger.spinthread.com [209.31.146.92])
	by puffer.spinthread.com (Postfix) with ESMTP id 924BB7C06
	for <freebsd-questions@freebsd.org>;
	Thu, 17 Mar 2005 13:24:10 -0500 (EST)
Received: from [10.0.33.71] (h-64-236-208-25.nat.aol.com [64.236.208.25])
	by mail.spinthread.com (Postfix) with ESMTP id 10162211AB
	for <freebsd-questions@freebsd.org>;
	Thu, 17 Mar 2005 13:24:10 -0500 (EST)
Message-ID: <4239CB49.40707@mail.com>
Date: Thu, 17 Mar 2005 13:24:09 -0500
From: Yanek Korff <yanek@mail.com>
User-Agent: Mozilla Thunderbird 0.6 (Macintosh/20040502)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: freebsd-questions@freebsd.org
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Data Recovery
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Mar 2005 18:24:11 -0000


Are there any ways to recover files from rm -rf dirname after a few 
days, assuming there have been few if any writes to the filesystem since?

I've been playing with tools like foremost and jpegrescue a bit... and 
running tests on other filesystems, but it doesn't appear that I'm 
getting full images back from the disk.  Looking at an octal dump of a 
disk image (dd if=/dev/blah of=/some/file), I can find the file 
header... and about 20k of the file, generally... and then there's 
garbage.  Presumably the file's been broken into blocks and there's 
inode table data to consider...

The tests I"m running are trying to find jpeg files that HAVEN'T been 
deleted from the filesystem.  My real scenario of course differs.

Pointers/rtfm welcome.

-Yanek.