> From: Christopher J Mason <cmason+@CMU.EDU>

(Been ages since I saw a user+@ address....)

> Without sounding like a complete idiot, is it possible to recover
> text from accidentally deleted files on a ufs filesystem?

In some circumstances, yes.

> If I can remember a phrase from the file can I search the unused disk
> media for this phrase, possibly recovering text?

In theory.  In practice, it is probably easier to search the entire
disk device, something like "dd if=/dev/rsd0c | grep 'my phrase'".  Of
course, the phrase may straddle a block boundary; it would help if you
had multiple phrases to search for, and of course there is a danger of
false positives, a danger of the blocks having been overwritten if the
filesystem is still active, and the difficulty of assembling random
blocks into a file.

> I accidentally overwrote a file by cat'ting > into it.  Does Netbsd
> reuse the file blocks (completely destroying the original data) or
> does it in effect allocate a totally new file (leaving the
> possibility that data might still exist on the disk).

Using "cat >" will truncate the file to zero size before writing
anything; this frees all its originally held blocks.  Those of them
that have not since been allocated to hold anything should still be
untouched (of course something was allocated to hold the data you
wrote, but depending on many things too complicated to usefully
describe here, different blocks may have been chosen.)

I once looked at making ufs support an un-delete call.  (This was back
under 4.3BSD, but ffs isn't much different from ufs of those days.)
Turned out too much information was destroyed to make it feasible,
though it probably could have been done with a bit of hackery.

					der Mouse

			       mouse@rodents.montreal.qc.ca
		     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B