Recover a ufs2 filesystem from a reformat with another ufs2 filesystem

[Ivan Voras]

On 13/02/2011 21:39, Anders Andersson wrote:

> 1) If an old file system is overwritten by a new file system with the
> same size, are there any traces of the old file system meta data left?
> I'm thinking randomized backup headers scattered throughout the file
> system, which would have a different location after each new format.

No, not randomized at all, unfortunately for your purpose - there are 
copies of superblocks, but all important data is on precisely 
deterministic positions for somewhat the same reasons - to help recovery 
in case parts of it are missing.

> 2) If there are no traces left of the old file system, would there be
> any UFS2-aware recovery programs that could scan the disk and try to
> regenerate the necessary meta data from, say, partition size, file
> offsets, some other magic...?

Yes, there are tools which scan the entire drive / partition and try to 
identify blocks which look like directories and files, but then you need 
to recover inodes. Fortunately, not all inodes are pre-initializes in 
UFS2, some may be salvagable. In any case, I don't predict much success.

The process would use some of the same tools like "undeleting" files, see

* http://www.google.com/search?q=freebsd+undelete
* http://www.google.com/search?q=freebsd+recover+filesystem

(it's been a long time I tried something similar, I don't know which 
tools I used).

> 3) Are there any powerful tools availaible for tasks like this in
> FreeBSD that are not ported to Linux? In that case, I could easily
> install FreeBSD in a virtual machine and salvage the files there.

Not likely.

> 4) If everything else fails, can you recommend a good overview about
> UFS2, how and where the bits and pieces are stored on disk?

That would be a very complicated but also very interesting way to learn 
in extreme details about a file system :)

I don't know of any online description of UFS2 (note: "UFS" systems are 
slightly different in all BSDs and very different in Solaris) except the 
sources but if you can find this book it will probably help you get 
started quickly:

http://www.amazon.com/Design-Implementation-FreeBSD-Operating-System/dp/0201702452

In any case, as others said, DO NOT WORK ON THE "LIVE" HARD DRIVE. Make 
a copy image of it.