Recover a ufs2 filesystem from a reformat with another ufs2
ivoras at freebsd.org
Mon Feb 14 00:36:01 UTC 2011
On 13/02/2011 21:39, Anders Andersson wrote:
> 1) If an old file system is overwritten by a new file system with the
> same size, are there any traces of the old file system meta data left?
> I'm thinking randomized backup headers scattered throughout the file
> system, which would have a different location after each new format.
No, not randomized at all, unfortunately for your purpose - there are
copies of superblocks, but all important data is on precisely
deterministic positions for somewhat the same reasons - to help recovery
in case parts of it are missing.
> 2) If there are no traces left of the old file system, would there be
> any UFS2-aware recovery programs that could scan the disk and try to
> regenerate the necessary meta data from, say, partition size, file
> offsets, some other magic...?
Yes, there are tools which scan the entire drive / partition and try to
identify blocks which look like directories and files, but then you need
to recover inodes. Fortunately, not all inodes are pre-initializes in
UFS2, some may be salvagable. In any case, I don't predict much success.
The process would use some of the same tools like "undeleting" files, see
(it's been a long time I tried something similar, I don't know which
tools I used).
> 3) Are there any powerful tools availaible for tasks like this in
> FreeBSD that are not ported to Linux? In that case, I could easily
> install FreeBSD in a virtual machine and salvage the files there.
> 4) If everything else fails, can you recommend a good overview about
> UFS2, how and where the bits and pieces are stored on disk?
That would be a very complicated but also very interesting way to learn
in extreme details about a file system :)
I don't know of any online description of UFS2 (note: "UFS" systems are
slightly different in all BSDs and very different in Solaris) except the
sources but if you can find this book it will probably help you get
In any case, as others said, DO NOT WORK ON THE "LIVE" HARD DRIVE. Make
a copy image of it.
More information about the freebsd-fs