ufs recovery

[Roland Smith]

On Sun, Sep 08, 2013 at 10:46:35AM +0200, Laszlo Danielisz wrote:
> Hi,
> 
> By mistake I forgot to edit my crontab on my FreeBSD 8.3 after I took out
> one of the hard drives.  I had a little rsync script which I used to
> synchronise a directory between those two hard drives, because one of the
> hard drives were not present anymore and rsync had the --delete parameter I
> end up deleting the whole directory, of course with precious informations.

Ouch. I have a similar procedure going. But I put it in a shell-script that
mounts the destination _and_ checks if the destination is properly mounted _before_
starting the rsync. I would suggest you do something similar in the future.

Just to be clear, was the information deleted from _both_ harddisks?

> I have ufs on the hdd, after the "accident" I've turned off the computer to
> avoid any writings on the disk.  Do you have any idea how can I recover the
> lost directory?

Do you perhaps have a snapshot of the filesystem in question available? If so,
you can mount that and restore the files from it. See e.g.:
http://www.freebsd.org/doc/handbook/snapshots.html

If all else fails, have a look at sysutils/sleuthkit. Restoring deleted files
on UFS is very difficult, but you can find some pointers here:

http://wiki.sleuthkit.org/index.php?title=FS_Analysis#Manual_Deleted_File_Recovery

It helps if you know what kind of data is contained in the deleted file.

To prevent this from happening again, make regular backups e.g. to an external
harddisk that you use for that purpose alone.


Roland
-- 
R.F.Smith                                   http://rsmith.home.xs4all.nl/
[plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated]
pgp: 1A2B 477F 9970 BA3C 2914  B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20130909/a031256f/attachment.sig>