On Mon, 7 Jul 2008, macintoshzoom wrote:
> I deleted a directory from an OpenBSD slice from my 2nd HD, and I need
> to recover a single file.
>
> I tried : http://myutil.com/2008/1/15/undelete-unrm-for-openbsd-4-2-with-dls
> but failed :
>
> # dls /dev/wd1x > /xxx/xx/undelete.bin
> Sector offset supplied is larger than disk image (maximum: 0)
Nobody here is likely to be familiar with this software or
its error messages. Why not ask its author?
> Help & thanks.
If it is in a ffs filesystem, and it probably is, undeletion is a
fruitless task. It can be done. But it is not easy, and the skill
has died out among Unix people under the age of about 50. (The
chief tool, fsedit(8), is no longer distributed. Another useful
tool, dumpfs(8) is still around.) It required working knowledge
of the lowest details of a filesystem, sufficient knowledge to build
and dissect a filesystem inode by inode. fsedit() was better than
just using a hex editor. I have, *sigh*, used it, on SYSV in the
mid 1980's. It was terrifying. I rebuilt a whole lousy filesystem
with corrupted inodes. Never again...
The file might be recoverable if you had pulled the power plug
(not run "shutdown") immediately after the rm. But it would require
knowledge. (The dls webpage says to run shutdown: that is a mistake.
Shutdown sync's the disks by default. You wanted shutdown -n and
probably "shutdown -n -k now", unless the rm'ed file was on /, in
which case you pull the plug, no not the off switch, you pull the
plug from the wall or hit a big red panic button that throws the
circuit breakers.
You've asked on three or four mailing lists. Everyone says: forget
it. One more time: forget it. This is one of the small pleasures,
in the category of Schadenfreude, of admining unix, telling users
that "Your file hath gaily fled thither, where the woodbine twineth."
When it's the boss's file, you add, "You should have approved my
request for more backup tapes."
This isn't MS-DOS. That's the only filesystem I've heard of until
lately that even had the hope of undeletion. Perhaps these new-fangled
journal filesystem like the one written by the unfortunate Mr.
Reiser, have such a feature. Perhaps certain RAID configurations
have such things.
Young people seem to like undeletion. They are not used to unix
yet. They want their Ubuntu, to which they are welcome.
If the file is valuable, you might hire a consultant, pay $1000
a day, and probably be disappointed.
Let me put it this way: removing a file is a lot like burning a
paper document: you are left with ashes. If you don't stir the ashes,
and study them with a microscope in a laboratory, you might discover
what was on the document.
If you have been using the filesystem mounted at all, you've been
stirring the ashes. Inodes (the places where data about files
are stored) are overwritten and reused quickly. Some of this is
for security. When you rm "/home/stuff/bomb.jpg" as the police
are breaking down your door, you would like at least some assurance
that it will not reappear to a $5 utility in the hands of po-lees
egg-spurt with a mail-order certificate in "Disks 'n' Stuff" and
a CD with "magic cop tools" on it.
Try that dls thing again, but find someone who has used it.
Try asking on a FreeBSD list, there are many more users of FreeBSD,
and they tend to be hopers and believers in magic.
Dave
--
The future isn't what it used to be.
-- G'kar
_______________________________________________
Openbsd-newbies mailing list
[email protected]
http://mailman.theapt.org/listinfo/openbsd-newbies
