Recovering Trashed Filesystems

[Crist J. Clark]

I have two file systems in very sad shape that I would like
to retrieve some files from. I've net booted the sick box
and can access the two bad UFSs. One file system, the root
file system, isn't too bad off. However, the usr directory
is messed up. I can do,

  # ls
  .cshrc          boot            lib             proc            tmp
  .profile        dev             libexec         rescue          usr
  .snap           entropy         lost+found      root            var
  COPYRIGHT       etc             media           sbin
  bin             home            mnt             sys

But if I try look at the files (directories),

  # ls -l
  ls: lib: Bad file descriptor
  ls: usr: Bad file descriptor
  ls: var: Bad file descriptor
  total 52
  -rw-r--r--   2 root  wheel      787 Jun 25  2008 .cshrc
  -rw-r--r--   2 root  wheel      253 Jun 20  2008 .profile
  drwxrwxr-x   2 root  operator   512 Jun 27  2008 .snap
  -r--r--r--   1 root  wheel     6188 Jun 20  2008 COPYRIGHT
  drwxr-xr-x   2 root  wheel     1024 Jun 20  2008 bin
  drwxr-xr-x   8 root  wheel      512 Jun 28  2008 boot
  dr-xr-xr-x   2 root  wheel      512 Jun 28  2008 dev
  -rw-------   1 root  wheel     4096 Nov 26  2008 entropy
  drwxr-xr-x  20 root  wheel     2560 Jun 19 22:35 etc
  drwxr-xr-x   2 root  wheel      512 Jun 25  2008 home
  drwxr-xr-x   2 root  wheel      512 Jun 20  2008 libexec
  drwx------   2 root  wheel     2048 May 23 07:47 lost+found
  drwxr-xr-x   2 root  wheel      512 Jun 20  2008 media
  drwxr-xr-x   2 root  wheel      512 Jun 20  2008 mnt
  dr-xr-xr-x   2 root  wheel      512 Jun 20  2008 proc
  drwxr-xr-x   2 root  wheel     2560 Jun 20  2008 rescue
  drwxr-xr-x   4 root  wheel      512 Jul 27 21:26 root
  drwxr-xr-x   2 root  wheel     2560 Jun 20  2008 sbin
  lrwxr-xr-x   1 root  wheel       11 Jun 20  2008 sys -> usr/src/sys
  drwx------   2 root  wheel      512 Jun 26  2008 tmp

We see "usr" is messed up. And what I'd like to recover are
files up in usr/local/etc.

Now I can "mount -r /dev/ad0s1a /mnt" to get the above results,
but "fsck /dev/ad0s1a" returns,

  # fsck /dev/ad0s1a
  ** /dev/ad0s1a
  BAD SUPER BLOCK: VALUES IN SUPER BLOCK DISAGREE WITH THOSE IN FIRST ALTERNATE

  LOOK FOR ALTERNATE SUPERBLOCKS? [yn] y

  32 is not a file system superblock
  SEARCH FOR ALTERNATE SUPER-BLOCK FAILED. YOU MUST USE THE
  -b OPTION TO FSCK TO SPECIFY THE LOCATION OF AN ALTERNATE
  SUPER-BLOCK TO SUPPLY NEEDED INFORMATION; SEE fsck(8).

Some help on recovering the files? I don't need the whole
disk intact. As I said, I just want to track down some local
stuff in usr/local/etc.

As for the second file system, the "var" file system, it is
more messed up. Looks like big chucks are zeroed out. But
again, there are a few files I would like to recover. I
have managed to recover one important one by running,

  # dd if=/dev/ad0s1f | hexdump -C | more

And manually finding the file and then using,

  # dd if=/dev/ad0s1f skip=<m> count=<n> > /tmp/recovered.txt

Then manually editing. But that is too labor intensive to try
to grab everything.

Again, when I fsck(1) I get the same message as above. Anyone
have tools for recovering files from these broken file systems?
-- 
Crist J. Clark                     |     cjclark at alum.mit.edu