Date: Sat, 26 Nov 2005 10:42:07 -0700 From: Scott Long <scottl@samsco.org> To: user <user@dhp.com> Cc: freebsd-fs@freebsd.org Subject: Re: remind me ... (file undelete on FreeBSD 5.4) Message-ID: <43889E6F.80008@samsco.org> In-Reply-To: <Pine.LNX.4.21.0511261216070.8180-100000@shell.dhp.com> References: <Pine.LNX.4.21.0511261216070.8180-100000@shell.dhp.com>
next in thread | previous in thread | raw e-mail | index | archive | help
user wrote: > > On Sat, 26 Nov 2005, Arne W�rner wrote: > > >>I just remembered, that there is a tool called "fsdb" (file system >>debugger; it is already contained in the base system), which might >>see deleted files and directory-files... Maybe increasing the link >>count (from 0 to 1) of those directory entries brings back the >>files/dirs? Maybe I am too naive... > > > > Comments from anyone on this suggestion ? > > I may just try this if it is workable. Otherwise I am not going to > bother. It was not important data, and I am already over it. > When a file is deleted (in technical terms, when the last reference on the inode goes away), its inode on disk is zeroed. The inode contains all of the block pointers for the file data. This isn't like MSDOS where you can bring back the file entry and reference it in the FAT to find the blocks. With a lot of work, if you know exactly what data you are looking for, you can search the free block bitmap and make educated guesses about clustering of data blocks. At one time I think there were tools to help with the scan and search, but really, it's not very feasable, and its not something that can be automated. If the data is that important, take it to a professional lab and have them recover the zeroed inode through hysterisis analysis. Scott
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?43889E6F.80008>