From owner-freebsd-hackers Fri Feb 12 15:32:28 1999 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id PAA22517 for freebsd-hackers-outgoing; Fri, 12 Feb 1999 15:32:28 -0800 (PST) (envelope-from owner-freebsd-hackers@FreeBSD.ORG) Received: from smtp01.primenet.com (smtp01.primenet.com [206.165.6.131]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id PAA22502 for ; Fri, 12 Feb 1999 15:32:25 -0800 (PST) (envelope-from tlambert@usr01.primenet.com) Received: (from daemon@localhost) by smtp01.primenet.com (8.8.8/8.8.8) id QAA18449; Fri, 12 Feb 1999 16:32:20 -0700 (MST) Received: from usr01.primenet.com(206.165.6.201) via SMTP by smtp01.primenet.com, id smtpd018379; Fri Feb 12 16:32:14 1999 Received: (from tlambert@localhost) by usr01.primenet.com (8.8.5/8.8.5) id QAA25413; Fri, 12 Feb 1999 16:31:37 -0700 (MST) From: Terry Lambert Message-Id: <199902122331.QAA25413@usr01.primenet.com> Subject: Re: data recovery ? To: sec@pi.musin.de (Stefan `Sec` Zehl) Date: Fri, 12 Feb 1999 23:31:26 +0000 (GMT) Cc: freebsd-hackers@FreeBSD.ORG In-Reply-To: <19990211141454.A23872@yoda.pi.musin.de> from "Stefan `Sec` Zehl" at Feb 11, 99 02:14:54 pm X-Mailer: ELM [version 2.4 PL25] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > A friend of mine (no, not me :-) just managed to do a fresh 3.0 install > on his box without saving his previous data to another box. > He had one home.tar lying in /usr before he re-paritioned and > reinstalled. > > Is there _any_ way to recover it now? Unfortunately nobody here has > enough knowledge of the filesystem structure for ufs. > > Are there any pointers on what we can try to recover this .tar now, or > are we lot ? If you haven't done anything else to the disk since doing this, and the home.tar was truly a home.tar and not compressed, then the contents should be plaintext. In general, if you didn't change the offset of the start, or you changed it in a 4M increment, then you don't have to worry about cylinder group data having squatted on your file. You may have inode data, or other data that has eaten holes in the home directory. Any binary files you had are goners. Write them off now. For text files, you can read the disk for recognizable chunks of the text. They will most likely be in to 9 times runs of data (to account for clustering). I've often thought that tar should ftruncate/fcntl files larger by the run of the file it was about to archive plus metadata, in order to promote clustering of archives. I once recovered 6 weeks of work on a Motif clone this way; it's time consuming, but you can do it. You will probably need to write some dumb little raw device grep and ofset cluster grabbing tools; I tend to rewrite these each time I have to recover data, since they're no more than 30 or so lines of code each, so I don't have them to send to you. If you find the task onerous, be sure to submit them as ports so that they can become widely available. Terry Lambert terry@lambert.org --- Any opinions in this posting are my own and not those of my present or previous employers. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message