topic Re: deleted file in Operating System - HP-UX https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156192#M158501 Yes from backup tapes .<BR />But otherwise , I don't think so . Mon, 05 Jan 2004 11:31:20 GMT Ashwani Kashyap 2004-01-05T11:31:20Z deleted file https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156191#M158500 Hi,<BR />is there some possibility to recover a deleted file (vxfs file system)?<BR />Thanks for your help in advance.<BR /><BR />Laszlo Mon, 05 Jan 2004 11:29:32 GMT https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156191#M158500 Laszlo Pap 2004-01-05T11:29:32Z Re: deleted file https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156192#M158501 Yes from backup tapes .<BR />But otherwise , I don't think so . Mon, 05 Jan 2004 11:31:20 GMT https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156192#M158501 Ashwani Kashyap 2004-01-05T11:31:20Z Re: deleted file https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156193#M158502 Laszlo,<BR /><BR />Unfortunately, there is no "undelete" in Unix. There is a very complex method to recover a file, *IF* the inodes have not been reused, but, as a general rule, the answer is no. I'll see if I can find the thread that explains the complex undelete via inode method. In the meantime, try to minimize activity in that file system!<BR /><BR /><BR />Pete Mon, 05 Jan 2004 11:33:10 GMT https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156193#M158502 Pete Randall 2004-01-05T11:33:10Z Re: deleted file https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156194#M158503 Laszlo<BR /><BR />No you cant undelete. <BR />Reocvery is only restoring it from another place.<BR /><BR />Manoj Srivastava Mon, 05 Jan 2004 11:36:13 GMT https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156194#M158503 MANOJ SRIVASTAVA 2004-01-05T11:36:13Z Re: deleted file https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156195#M158504 Once i found this procedure, but never tried myself. For an important file, i would use a backup.<BR /><BR /><BR />## Just verify the file here, its inode and size ##<BR /><BR /># bdf|grep fs<BR />/dev/vg01/lvol1 20480 17371 2938 86% /fs<BR /># ll -i /fs/james/itrc/map/myfile<BR /> 412 -rw-r--r-- 1 root sys 1988 Dec 18 11:48 /fs/james/itrc/map/myfile<BR /># cat /fs/james/itrc/map/myfile<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />0000000000000000000000000000000000000000000000000000000000000000000000<BR />00000000000000000 This is an itrc fsdb test!! 000000000000000000000000<BR />0000000000000000000000000000000000000000000000000000000000000000000000<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR /><BR />## unmount filesystem and use ncheck to confirm inode (as if crashed) ##<BR /><BR /># umount /fs<BR /># ncheck -F vxfs /dev/vg01/rlvol1|grep 412<BR />412 /james/itrc/map/myfile<BR /><BR />## Use fsdb... we want to go into the 999 (user) fileset then go to ##<BR />## the inode in question. Here we can see block allocation which we ##<BR />## can use to dd it off. If there are indirect blocks I have no idea #<BR /><BR /># fsdb -F vxfs /dev/vg01/rlvol1 <BR />&gt; 999fset<BR />fset header structure at 0x0000000a.0000<BR />fsh_fsindex 999 fsh_fsetname "UNNAMED"<BR />fsh_version 4 fsh_checksum 0xbfb7af5c<BR />fsh_time 1071747956 420001 (Thu Dec 18 11:45:56 2003 BST)<BR />fsh_ninode 544 fsh_nau 1 fsh_old_ilesize 0 fsh_eopdata 0<BR />fsh_fsextop 0x0 fsh_dflags 0x11 fsh_quota 0 fsh_maxinode 4294967295<BR />fsh_ilistino[65 97] fsh_iauino 64 fsh_lctino 0 fsh_uquotino 69<BR />fsh_attr_ninode 0 fsh_attr_nau 0 fsh_attr_eopdata 0<BR />fsh_attr_ilistino[67 99] fsh_attr_iauino 66 fsh_attr_lctino 68<BR />fsh_features 0x0<BR />fsh_previx 0 fsh_nextix 0<BR />fsh_ctime 1071747083 401017 (Thu Dec 18 11:31:23 2003 BST)<BR />fsh_mtime 1071747956 420000 (Thu Dec 18 11:45:56 2003 BST)<BR />&gt; 412i<BR />inode structure at 0x0000219f.0000<BR />type IFREG mode 100644 nlink 1 uid 0 gid 3 size 1988<BR />atime 1071748117 310011 (Thu Dec 18 11:48:37 2003 BST)<BR />mtime 1071748082 190000 (Thu Dec 18 11:48:02 2003 BST)<BR />ctime 1071748082 190000 (Thu Dec 18 11:48:02 2003 BST)<BR />aflags 0 orgtype 1 eopflags 0 eopdata 0<BR />fixextsize/fsindex 0 rdev/reserve/dotdot/matchino 0<BR />blocks 2 gen 0 version 0 17 iattrino 0<BR />de: 14014 0 0 0 0 0 0 0 0 0 <BR />des: 2 0 0 0 0 0 0 0 0 0 <BR />ie: 0 0 <BR />ies: 0 <BR /><BR />## The de number is the block ##<BR />## the des number is the count from that location, directly below ##<BR />## now find the block size ##<BR /><BR /> # fstyp -v /dev/vg01/rlvol1 <BR />vxfs<BR />version: 4<BR />f_bsize: 8192<BR />f_frsize: 1024 &lt;---- here<BR />f_blocks: 20480<BR />f_bfree: 3109<BR />f_bavail: 2915<BR />f_files: 1320<BR />f_ffree: 776<BR />f_favail: 776<BR />f_fsid: 1073807361<BR />f_basetype: vxfs<BR />f_namemax: 254<BR />f_magic: a501fcf5<BR />f_featurebits: 0<BR />f_flag: 0<BR />f_fsindex: 5<BR />f_size: 20480<BR /><BR />## Now the dd - skip to our "de" and pull "des" off. ##<BR /><BR /># dd if=/dev/vg01/rlvol1 of=/tmp/hope bs=1024 skip=14014 count=2<BR />2+0 records in<BR />2+0 records out<BR /><BR />## verify file ##<BR /><BR /># cat /tmp/hope<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />0000000000000000000000000000000000000000000000000000000000000000000000<BR />00000000000000000 This is an itrc fsdb test!! 000000000000000000000000<BR />0000000000000000000000000000000000000000000000000000000000000000000000<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR />1111111111111111111111111111111111111111111111111111111111111111111111<BR /><BR />## bingo! :-) But note the extra bytes :-( ##<BR /><BR /># ll /tmp/hope<BR />-rw-r--r-- 1 root sys 2048 Dec 18 11:53 /tmp/hope<BR /><BR /><BR /> Mon, 05 Jan 2004 11:38:34 GMT https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156195#M158504 Massimo Bianchi 2004-01-05T11:38:34Z Re: deleted file https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156196#M158505 sorry this is not windoz I hope you have a backup on tape<BR /><BR />John. Mon, 05 Jan 2004 11:39:11 GMT https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156196#M158505 John Carr_2 2004-01-05T11:39:11Z Re: deleted file https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156197#M158506 Laszlo,<BR /><BR />Unfortunately I was unable to find the process I was looking for but I think Massimo's procedure looks like the same one.<BR /><BR /><BR />Pete Mon, 05 Jan 2004 11:45:57 GMT https://community.hpe.com/t5/operating-system-hp-ux/deleted-file/m-p/3156197#M158506 Pete Randall 2004-01-05T11:45:57Z