----- In short:
there is no way to recover deleted binary files under UNIX unless you
have taken some precautions BEFORE the catastrophe. You may be able
to recover deleted text files by analyzing the blocks in the free
block list directly. Recovering large files with many blocks is
probably hopeless even in this case.
Of course I am not the first dunce that has done this.
Chris Osicki (osicki@hasler.ascom.ch) send me a file of messages he collected
on the problem, which includes sources for a program by Mike Morton
(mikem@uhccux.uhcc.Hawaii.Edu) (for the NeXT station) to analyze free
blocks and some further helpful things.
----- Specific things you can do and rays of hope:
Norton Utilities for SysV allegedly has a tool for file recovery, but
I don't know the conditions under which it works.
Bill Gilroy (wmg@smuxa.att.com ) sent me a technique for using dd to
save the raw partition and then analyze it. Similar to this was a suggestion
by Markus Wagener <Markus.Wagener@EROS.Chemie.TU-Muenchen.DE> to look at the
raw device. Terry Rosenbaum <tlr@radiology.msu.edu> also gave this as a
possibility, but reminded me that the data blocks are physically scattered
all across the disk, so that, without a list of these blocks, one cannot
put a binary file back together. He indicated that there ARE tools to
undelete files, but these require a daemon that keeps track of changes
to the file system BEFORE the problem occurs.
Kevin Sheehan (kalli!fourx!kuma3.Japan.Sun.COM!kevins@fourx.Aus.Sun.COM)
indicated that Sun Consulting has some tools for searching free lists and
putting back inode and indirect trees, which he wrote.
Birger Wathne (birger@vest.sdata.no) mentioned buying a custom program for
this program from a software house -- That costs money, unfortunately, and
my budget for this year is zilch.
-----
I am not including the text of the replies here to save bandwidth. I will
mail them to anyone who wants them.
----- Thanks to:
birger@vest.sdata.no (Birger A. Wathne)
ross@dseg.ti.com (Tony Ross )
wmg@smuxa.att.com (Bill Gilroy)
kalli!fourx!kuma3.Japan.Sun.COM!kevins@fourx.Aus.Sun.COM (Kevin Sheehan {C
onsulting Poster Child})
osicki@hasler.ascom.ch (Chris Osicki) who included earlier messages from
kellow@ndcheg.cheg.nd.edu (John Kellow)
esanborn@cadence.com (Ed Sanborn)
mikem@uhccux.uhcc.Hawaii.Edu (Mike Morton)
Markus Wagener <Markus.Wagener@EROS.Chemie.TU-Muenchen.DE>
Terry Rosenbaum <tlr@radiology.msu.edu>
pmetzger@shearson.com (Perry E. Metzger)
eckhard@ts.go.dlr.de (Eckhard Rueggeberg)
--------------------------------------------------------------------------------
\ ..\ /../ Howard Schultens Tel: ++49 551 39 5914
\.o.\ /../ Zentrum Physiologie FAX: ++49 551 39 5923
\o.o> /: / Abteilung Neuro- und
\o/ / \ Sinnesphysiologie E-Mail: hs@demeter.ukps.gwdg.de
Y R .oo \ Humboldtallee 23
/ o o.o \ D-3400 Goettingen
<_*o*_*.*_> Germany
--===r=R=r=Rr===----------------------------------------------------------------
This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:06:48 CDT