From owner-freebsd-questions  Sun Jul 27 14:10:57 1997
Return-Path: <owner-freebsd-questions>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id OAA21802
          for questions-outgoing; Sun, 27 Jul 1997 14:10:57 -0700 (PDT)
Received: from imdave.pr.mcs.net (imdave@imdave.pr.mcs.net [205.164.3.77])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id OAA21771
          for <freebsd-questions@FreeBSD.ORG>; Sun, 27 Jul 1997 14:10:48 -0700 (PDT)
Received: (from imdave@localhost)
	by imdave.pr.mcs.net (8.8.6/8.8.6) id QAA27805;
	Sun, 27 Jul 1997 16:10:15 -0500 (CDT)
Date: Sun, 27 Jul 1997 16:10:15 -0500 (CDT)
From: Dave Bodenstab <imdave@mcs.net>
Message-Id: <199707272110.QAA27805@imdave.pr.mcs.net>
To: mc4469@mclink.it
Subject: Re: Undelete a file, how ?
Cc: freebsd-questions@FreeBSD.ORG
Sender: owner-freebsd-questions@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

>
> > Hi all.
> > 
> > Is there a way to undelete a file under FreeBSD 2.2.1 ?
> > 
> > Regards.
>
> Yes, its called a backup. :)
>
This answer is correct.  However, if you act fast, and the file
is important enough to justify this extremely labor intensive method,
the following has worked for me.

Immediately cease any activity that would cause further writes to the file
system containing the deleted file.  The best solution is to unmount the
file system.  I used dd and GNU's split to copy the raw data, in fairly
easily managed chunks -- say 100K each, from the slice (/dev/rwds... or
/dev/rsd...) to a scratch area.  Obviously, the scratch area needs to be
larger than the original file system, or you'll have to do this a section
at a time.  Then, using GNU's fgrep (I don't know if the stock fgrep will
handle files containing mucho binary data) I look for a string that I
know was in the file in question.  This assumes that we're dealing with
a text file... a binary file would be next to impossible to deal with.
This identifies the chunks of the original file system that may contain
the data from the deleted file.  Next, using an editor (I use vim)
I edit the likely chunks, search for the data, and reconstruct the contents
of the deleted file.

I have successfully used this to recover the contents of a file
that I had spent much time just editing, and then deleted it ;-(


Another possible solution would be to read the source and determine
what happens when a file is deleted from the file system type in
question.  Long ago, using system 5's file system type, it was possible
to recover a file because the file's blocks were added to the free
list in a predictable way.  If nothing wrote to the drive after a file
was deleted, the file could be recovered if one acted quickly.

Dave Bodenstab
imdave@mcs.net