remind me ... (file undelete on FreeBSD 5.4)

[Scott Long]

user wrote:
> 
> On Sat, 26 Nov 2005, Arne W�rner wrote:
> 
> 
>>I just remembered, that there is a tool called "fsdb" (file system
>>debugger; it is already contained in the base system), which might
>>see deleted files and directory-files... Maybe increasing the link
>>count (from 0 to 1) of those directory entries brings back the
>>files/dirs? Maybe I am too naive...
> 
> 
> 
> Comments from anyone on this suggestion ?
> 
> I may just try this if it is workable.  Otherwise I am not going to
> bother.  It was not important data, and I am already over it.
> 

When a file is deleted (in technical terms, when the last reference on
the inode goes away), its inode on disk is zeroed.  The inode contains
all of the block pointers for the file data.  This isn't like MSDOS
where you can bring back the file entry and reference it in the
FAT to find the blocks.  With a lot of work, if you know exactly what
data you are looking for, you can search the free block bitmap and make
educated guesses about clustering of data blocks.  At one time I think
there were tools to help with the scan and search, but really, it's not
very feasable, and its not something that can be automated.  If the
data is that important, take it to a professional lab and have them
recover the zeroed inode through hysterisis analysis.

Scott