recovering data

Chris Pressey cpressey at
Tue Nov 11 12:31:34 PST 2003

On 11 Nov 2003 11:41:15 -0500
Lowell Gilbert <freebsd-questions-local at> wrote:

> carmoda < at> writes:
> > I would like to know if there is a proceedure i might be able to
> > follow to recover a file that was deleted on a FreeBSD fileserver
> > with SAMBA from a Windows 2000 workstation..
> > 
> > i know the file's name and i have powered down the server.
> The usual approach is to get it from your backups.
> The inode would help more than the filename, but you still might be
> able to retrieve it if you are thoroughly knowledgeable in filesystem
> internals.  Since you're asking the question, I assume you're not.
> You might look around for a tool that (if I recall correctly) is
> called the Coroner's Toolkit.

One trick I'm aware of, if you know some of the contents of the file, is

- unmount the file system the file was on
- grep through the raw device the file system was mounted on,
  looking for the known contents
- copy those contents to a new file on another file system

Some problems with this method are that the data isn't always stored
contiguously (thus you may only be able to recover part of the file near
the contents you know,) that the same contents might well occur in other
files (possibly older versions of the same file that were deleted in the
past), and that you're not likely to be aware of the contents of a
binary file.

However, I have used this method successfully to recover bits of program
source code that I accidentally wiped out.


More information about the freebsd-questions mailing list