Re: recover deleted file

On Sat, Apr 16, 2022 at 5:24 AM Sami Halabi <sodynet1@gmail.com> wrote:

> Hi,
> is there anyway easy to restore deleted file by accident in UFS????
>

Do you know what the contents of the file is? At least the first, say, ~32k?

The problem with unrm for ufs is that the directory entry has the inode
number stored in it.
Without the inode number, you won't get very far.
With the inode number, you can get the first 12 filesystem blocks of the
file and the
first three indirect blocks. Once you have those, you can reconstruct the
file.

But only if the inode hasn't been zero'd out (which it likely has, another
thing that makes
UFS undelete harder). But all hope isn't lost...  UFS has a predictable
allocation algorithm
that lets you get much of the file back (which is why I asked if you know
how it should start:
you can find where it starts in the data blocks and maybe get lucky with
the rest if the
data spills into indirect blocks).

However, that's only if you don't have TRIM enabled on the filesystem. If
you do,
then UFS will do a BIO_DELETE of the blocks, which means their contents are
likely gone at the drive level. I say likely because there's weasel words
in the ATA
spec that allows a drive to return the prior contents of the blocks, or all
zeros or
the drive's initialization pattern (usually all 1's) when the blocks are
later read. Same
goes for NVMe drives (with the additional constraint it must be
deterministic). So there's
may still be a chance you can read the old contents, but drives that do
that are rare
in my experience (which is admittedly quite narrow).

But, if you want to use fsdb to try to recover this data, or write your own
tools,
then you should likely have a copy of the daemon book (The Design and
Implementation
of the FreeBSD Operating System). It explains a lot of the finer details of
UFS and
reference to it likely will catch me where my memory isn't quite right in
the above
descriptions.

So, it's for all these reasons you can't find somebody with a unrm command
for ufs
like you can for DOS or other filesystems. I wish I had a better answer for
you.

Warner


> Sami
>
> --
> Sami Halabi
> Information Systems Engineer
> NMS Projects Expert, FreeBSD SysAdmin Expert
> Asterisk Expert
>