Date: Wed, 29 Oct 1997 03:07:30 +0100 (CET) From: Mikael Karpberg <karpen@ocean.campus.luth.se> To: grog@lemis.com (Greg Lehey) Cc: freebsd-hackers@FreeBSD.ORG Subject: Re: Recovering Lost Inode? Message-ID: <199710290207.DAA07672@ocean.campus.luth.se> In-Reply-To: <19971028153059.20678@lemis.com> from Greg Lehey at "Oct 28, 97 03:30:59 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
According to Greg Lehey: > On Mon, Oct 27, 1997 at 06:35:24PM -0600, James Buszard-Welcher wrote: > > Thanks for the response. I'm sure it's too late now, with inode > > recycling, etc. However, if I had been unable to umount the > > filesystem... (we now enter the theoretical zone) > > *could* I have been able to use somekindof Norton's Utilities-esque > > package for UNIX which could check inodes and look for ones that > > were 'file starters', and maybe check the that if all of the inodes > > pointed to by that starter inode (it was big file so I excect > > a level or two of inode redirection) were still intact it could > > pull it back? Kinda like an 'un-delete' fsck? Ever hear of > > such a thing? > > Good question. I don't have a good answer. The first big problem is > identifying the inode. You could have literally millions to check. But, _if_ he had not killed the daemon, it would still be holding a reference to the file. Maybe that could help, somehow? Is there in the case you know a program is holding a reference to a file, but the file has no link from a directory, any possibility of doing something like (after "kill -STOP" on the program, if it might terminate) syscall_saveme(procnum, the_procs_fd_for_the_file, "filename") as root to add a reference to the file referenced by a process? Or maybe something like syscall_copy_fds(procnum) that would allows a program get a copy of a running proc's filedescriptors (like if it was forked from the proc). The second thing should allow for reading it and copying it to a file, or possibly link it to a name, although I can't think of a nice call to do that with, right now. If this is not possible right now, would it be hard to do, and does it add any security holes? It seems it should, but I can't think of one. /Mikael
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199710290207.DAA07672>