Subject: Re: How to recover deleted files ?
To: Matthias Scheler <tron@zhadum.org.uk>
From: Mike M. Volokhov <mishka@netbsd.org>
List: netbsd-users
Date: 03/29/2007 12:25:17
Matthias Scheler <tron@zhadum.org.uk> wrote:
> On Fri, Mar 02, 2007 at 12:23:03AM -0700, Co Thai Ngo wrote:
[snip]
> > I'm looking for something like unrm, but couldn't find one.
> 
> I'm sorry but I don't think such an utility exists for NetBSD. And
> even if you had it it would require to stop the box immediately after
> accidently deleting the files because they might get overwritten
> otherwise.

AFAIU files cannot be recovered because most of data from inodes
is flushed, but dinode is treated as free in dependency of di_mode
field only.  So instead, we can flush just di_mode (backup it's
value at di_spare, see ufs/ufs/dinode.h) and clear inode/block
maps. Filesystem still be in consistent state and can be safely
fsck'ed.

For file recovering you should analyse all dinodes and those who had
no blocks intersections can be safely recovered by marking inode/block
maps and restoring di_mode.

This should be very easy to implement.

Sure, reconstructing the directory hierarchy is another thing.

--
Mishka.