Re: What is the best way to look for a lost file in the disk blocks

From: Matthias Apitz <guru_at_unixarea.de>
Date: Wed, 10 Aug 2022 07:26:27 UTC
El día miércoles, agosto 10, 2022 a las 07:18:03a. m. +0200, Michael Schuster escribió:

> On Wed, Aug 10, 2022 at 3:55 AM David Christensen
> <dpchrist@holgerdanske.com> wrote:
> >
> > On 8/9/22 05:23, Matthias Apitz wrote:
> > >
> > > Hello,
> > >
> > > Last night I damaged a plain UTF-8 HTML file (I copied by accident a
> > > JPEG file over it) and it turned out that the backup was done a month
> > > ago. I learned my lesson from this re/ doing backups more often of files
> > > I'm working on...

Thanks for the hints.

The file in question is my diary, written in Spanish and every day
is headed by a line like

<dt><b>Viernes, 29 de julio de 2022 </b>

So I wrote a 35 line C-programm reading any 1024 byte block from the
device, terminate it with '\0' to make sure that a 

char *p = strstr(block, " de 2022 </b>");

would not fail, and with p != NULL I printed with printf(p-16);
the diary entry; and the
current block number to be used in dd(1) later.
It finds all the lines of this year, but not the missing between July 10
and August 1 :-(
So the blocks have been lost. I was hoping that UFS puts them back to
free block chains for later use, but it seems that
the 'cp picture.jpg diary.html' directly overwrote the used blocks.

Lesson learned. I'm attaching the C-pgm, maybe someone can use it or at
least its idea.

	matthias


-- 
Matthias Apitz, ✉ guru@unixarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub