[net.unix-wizards] recovering deleted files

mp (05/15/82)

Last night, one of our inexperienced users, while in Emacs, accidentally
typed ^W before a ^X^W (^X^W writes out a file, ^W deletes large chunks
of a file) and thus lost all but 6 characters of her 5-page
file.  She didn't notice this until an hour after it happened.

Two of us spent 1.5 hours trying to recover the file.  Even
though prospects looked dim (I hear that blocks most recently freed
are the first to be reallocated), we tried everything from 
grepping through the raw disk for words in her file to examining
the inode list under adb in order to find which blocks her new, shorter
file occupied, then looking at the neighboring blocks.  Nothing
was successful.

I'm sure other people have run into this problem, and I'd like
to hear what people think should be done.  Does UNIX really allocate
recently-freed blocks first?  (If so, a program which would dump the
freelist would be nice to have.) Is there any policy of trying to
allocate blocks contiguously, so that if one block of a "deleted" file
is found, other blocks are likely to be nearby?

Having some tools which tell you what disk blocks a given inode
points to would have saved us a bit of time, too.  Fsdb is undoubtedly
still proprietary, I guess.

Oh yes, we're considering changing our emacs to write ".bak" files now.

	Mark Plotnick (eagle!mit-vax!mp or MP@ML)