jdubb@bucsf.bu.edu (jay dubb) (03/23/91)
I am posting this for a friend of mine who doesn't have access to USENET, so please respond directly to mlevin@jade.tufts.edu. I am at wit's end... I have Ultrix 4.1 running on a VaxStation II/RC. I had a file, called a.doc. By mistake, I did "cp b.doc a.doc". I am now desperate to get a.doc back. Is this possible? I know on DOS PCs, there is a utility to get back deleted files (provided you haven't actually written anything over them yet). What can I do to get as much of a.doc back as possible? I REALLY REALLY need it back! Please help. Mike Levin (mlevin@jade.tufts.edu)
alan@shodha.enet.dec.com ( Alan's Home for Wayward Notes File.) (03/23/91)
In article <77552@bu.edu.bu.edu>, jdubb@bucsf.bu.edu (jay dubb) writes: > > I am posting this for a friend of mine who doesn't have access > to USENET, so please respond directly to mlevin@jade.tufts.edu. As always I'll try... But this is of general interest... > > I am at wit's end... I have Ultrix 4.1 running on a VaxStation > II/RC. I had a file, called a.doc. By mistake, I did "cp b.doc a.doc". > I am now desperate to get a.doc back. Is this possible? I know on DOS > PCs, there is a utility to get back deleted files (provided you > haven't actually written anything over them yet). What can I do to > get as much of a.doc back as possible? I REALLY REALLY need it back! > Please help. I think it's unlikely any of this will work, but you can try. First. Prevent anything else from being written to that file system. This may crashing the system. You see the only way you can get that data is if those blocks didn't get overwritten when b.doc was copied to it (very unlikely) and nothing else has allocated them. Second, make a phsyical backup of the partition. That way you copy all the blocks that are there, not just the alloc- ated ones. You'll probably need to use dd(1). dd if=/dev/r{whatever} of=somewhere bs=filesystem-blocksize If you have enough disk space to clone the file system to a file then it will be easier if you clone the file system to a file. Otherwise just use a tape drive. Try to use a block that is the file system block of the file system being copied (either 4096 or 8192). Third - (The Easy Way) Use something to look at all the file system blocks, od(1) for example. Or write you own. It doesn't have to be too complex. Third - (The Hard Way) Write a program that understands the file system format. Use it to see what data blocks are free and look at them as in The Easy Way. There is almost enough information in section 5 of the manual to do this. The biggest problem that you'll face is the blocks of a.doc were probably overwritten by b.doc. If a.doc was bigger than b.doc then some of it will probably be left. > > Mike Levin > (mlevin@jade.tufts.edu) -- Alan Rollow alan@nabeth.cxn.dec.com