From owner-freebsd-hackers@FreeBSD.ORG Fri Jul 4 02:31:20 2003 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A88C137B401 for ; Fri, 4 Jul 2003 02:31:20 -0700 (PDT) Received: from mail.cyberonic.com (mail.cyberonic.com [4.17.179.4]) by mx1.FreeBSD.org (Postfix) with ESMTP id 70FAE43FAF for ; Fri, 4 Jul 2003 02:31:19 -0700 (PDT) (envelope-from jmg@hydrogen.funkthat.com) Received: from hydrogen.funkthat.com (node-40244c0a.sfo.onnet.us.uu.net [64.36.76.10]) by mail.cyberonic.com (8.12.8/8.12.5) with ESMTP id h649ZEMu003198; Fri, 4 Jul 2003 05:35:15 -0400 Received: (from jmg@localhost) by hydrogen.funkthat.com (8.12.9/8.11.6) id h649VbvD007910; Fri, 4 Jul 2003 02:31:37 -0700 (PDT) (envelope-from jmg) Date: Fri, 4 Jul 2003 02:31:37 -0700 From: John-Mark Gurney To: Josh Brooks Message-ID: <20030704093137.GA605@funkthat.com> Mail-Followup-To: Josh Brooks , freebsd-hackers@freebsd.org References: <20030704015704.Y57224-100000@mail.econolodgetulsa.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030704015704.Y57224-100000@mail.econolodgetulsa.com> User-Agent: Mutt/1.4.1i X-Operating-System: FreeBSD 4.2-RELEASE i386 X-PGP-Fingerprint: B7 EC EF F8 AE ED A7 31 96 7A 22 B3 D8 56 36 F4 X-Files: The truth is out there X-URL: http://resnet.uoregon.edu/~gurney_j/ X-Resume: http://resnet.uoregon.edu/~gurney_j/resume.html cc: freebsd-hackers@freebsd.org Subject: Re: recovering data from a truncated vn-file possible? X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: John-Mark Gurney List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Jul 2003 09:31:20 -0000 Josh Brooks wrote this message on Fri, Jul 04, 2003 at 01:59 -0700: > Is there anything at all I can do to get data out of this ? I know some > of it (750 megs worth) is gone for good - but can I get any of the rest of > it ? Presumably, when mounted, this was only 50% full ... If it was UFS1, then you can try ffsrecov in ports that I wrote. It won't compile on -current since UFS2 has gone into the tree. But it sounds like somehow the file got truncated, so of course any data in the last part that doesn't exist won't be recoverable. I'm not sure how robust ffsrecov is in handling the possible errors you might give it. If you need some help let me know, but you can try to recover inode 2 (the root inode) and see what you can get out of it. Hope this helps. -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not."