Date: Tue, 11 Nov 2003 12:34:20 -0800 From: Chris Pressey <cpressey@catseye.mine.nu> To: Lowell Gilbert <freebsd-questions-local@be-well.ilk.org> Cc: freebsd-questions@freebsd.org Subject: Re: recovering data Message-ID: <20031111123420.13afa9ca.cpressey@catseye.mine.nu> In-Reply-To: <44oevic0yc.fsf@be-well.ilk.org> References: <3FAEE02E.5040002@carmoda.com> <44oevic0yc.fsf@be-well.ilk.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 11 Nov 2003 11:41:15 -0500 Lowell Gilbert <freebsd-questions-local@be-well.ilk.org> wrote: > carmoda <freebsd.org@carmoda.com> writes: > > > I would like to know if there is a proceedure i might be able to > > follow to recover a file that was deleted on a FreeBSD fileserver > > with SAMBA from a Windows 2000 workstation.. > > > > i know the file's name and i have powered down the server. > > The usual approach is to get it from your backups. > > The inode would help more than the filename, but you still might be > able to retrieve it if you are thoroughly knowledgeable in filesystem > internals. Since you're asking the question, I assume you're not. > You might look around for a tool that (if I recall correctly) is > called the Coroner's Toolkit. One trick I'm aware of, if you know some of the contents of the file, is to: - unmount the file system the file was on - grep through the raw device the file system was mounted on, looking for the known contents - copy those contents to a new file on another file system Some problems with this method are that the data isn't always stored contiguously (thus you may only be able to recover part of the file near the contents you know,) that the same contents might well occur in other files (possibly older versions of the same file that were deleted in the past), and that you're not likely to be aware of the contents of a binary file. However, I have used this method successfully to recover bits of program source code that I accidentally wiped out. -Chris
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031111123420.13afa9ca.cpressey>