Re: What is the best way to look for a lost file in the disk blocks

On 8/9/22 05:23, Matthias Apitz wrote:
> 
> Hello,
> 
> Last night I damaged a plain UTF-8 HTML file (I copied by accident a
> JPEG file over it) and it turned out that the backup was done a month
> ago. I learned my lesson from this re/ doing backups more often of files
> I'm working on...
> Maybe there is a chance that the disk blocks are still not overwritten,
> what would be the best way to look for them block by block and if it
> contains certain string "foo-bar" having the block number from the
> beginning of the device to get it back with dd(1) into a file. Any
> scripts or tools for this?


You might be able to find raw blocks with grep(1) and/or Perl:

https://unix.stackexchange.com/a/710673


But, I do not know how UFS chains together blocks to form a file.


David


p.s. If you put your development directory on ZFS, you can use 
zfs-auto-snapshot to take snapshots on whatever schedule you want.