🚀 go-pugleaf

In article <77552@bu.edu.bu.edu>, jdubb@bucsf.bu.edu (jay dubb) writes:
> 
>    I am posting this for a friend of mine who doesn't have access
> to USENET, so please respond directly to mlevin@jade.tufts.edu.

	As always I'll try...  But this is of general interest...
> 
>    I am at wit's end... I have Ultrix 4.1 running on a VaxStation
> II/RC. I had a file, called a.doc. By mistake, I did "cp b.doc a.doc".
> I am now desperate to get a.doc back. Is this possible? I know on DOS
> PCs, there is a utility to get back deleted files (provided you
> haven't actually written anything over them yet).  What can I do to
> get as much of a.doc back as possible? I REALLY REALLY need it back!
> Please help.

	I think it's unlikely any of this will work, but you can
	try.

	First.  Prevent anything else from being written to that
	file system.  This may crashing the system.  You see the
	only way you can get that data is if those blocks didn't
	get overwritten when b.doc was copied to it (very unlikely)
	and nothing else has allocated them.

	Second, make a phsyical backup of the partition.  That way 
	you copy all the blocks that are there, not just the alloc-
	ated ones.  You'll probably need to use dd(1).

		dd if=/dev/r{whatever} of=somewhere bs=filesystem-blocksize

	If you have enough disk space to clone the file system to a
	file then it will be easier if you clone the file system to
	a file.  Otherwise just use a tape drive.  Try to use a block
	that is the file system block of the file system being copied
	(either 4096 or 8192).

	Third - (The Easy Way) Use something to look at all the file 
	system blocks, od(1) for example.  Or write you own.  It doesn't
	have to be too complex.

	Third - (The Hard Way) Write a program that understands the
	file system format.  Use it to see what data blocks are free
	and look at them as in The Easy Way.  There is almost enough
	information in section 5 of the manual to do this.

	The biggest problem that you'll face is the blocks of a.doc
	were probably overwritten by b.doc.  If a.doc was bigger than
	b.doc then some of it will probably be left.
> 
> 					Mike Levin
> (mlevin@jade.tufts.edu)


-- 
Alan Rollow				alan@nabeth.cxn.dec.com