How a file is deleted in ufs2?

[Scott Long]

Rick C. Petty wrote:
> On Mon, Apr 10, 2006 at 08:20:38PM -0500, Eric Anderson wrote:
> 
>>Hmm.. Can you explain then how a tool could recover rm'ed files (or just 
>>point me to the code snippet)?  There are a few tools that do this.  I 
>>was under the understanding that the direct/indirect/* lists got blasted 
>>away, but parts of the inode were left over.
> 
> 
> Nope, the whole inode gets cleared.  I thought this too and discovered the
> hard way.  Maybe without softupdates, I'm not sure??
> 

It happens the same with or without softupdates.  The one difference is
between UFS1 and UFS2.  With UFS1, doing a newfs also scrubs the inode
blocks.  UFS2 newfs doesn't scrub them, and the filesystem relies on a
flag to know to scrub them before using them the first time.  This was
done purely as an optimization for newfs, though it could technically
be used to help recover a filesystem that was accidentally newfs'd.

> There doesn't seem to be many tools that do this, at least with UFS2.  I
> wrote my own program to try to recover a toasted drive.  My program
> searches the free blocks on the disk looking for indirect blocks (i.e.
> blocks that have certain characteristics), validates those blocks, then
> pieces together the blocks into unnamed files (file names are stored in the
> directories, not in the inode or elsewhere).  This gives you all but the
> first 12 blocks of the file, due to the on-disk structure of inodes.  It
> tries some heuristics to guess at these blocks, but the success rate is
> very low.  As long as fewer blocks have been allocated & written to the
> disk then are available on the disk, it works well (because the allocation
> algorithm is highly deterministic).
> 
> Writing the program was a major headache, and it didn't work as well as I
> was hoping.  However it did allow me to spend much time into our UFS/FFS
> code (where I did discover some potential bugs--  haven't had time to
> submit patches yet).  I started this program because ffsrecov (still)
> doesn't work with UFS2.

I've heard rumors of a new ffsrecov written in Python that works with
UFS2.  You might want to contact John-Mark Gurney (jmg at freebsd.org) 
about it.

Scott