recovering inodes

[himacs]

Hi admins,

how to recover deleted inodes?

i heard that "rm" will only remove inodes not files.Files will be there in disk and new files overwrite that block with new inode.I believe if we recover deleted inode ,we can recover files of that inode.

plz correct me if i wrong and tell me how to recover deleted files/inodes.

regards
himacs

[James R. Ferguson]

Hi Himacs:

Yes, the data will remain on the disk until it is over-written. However, you should consider your file irrecoverable.

Unix does exactly what you tell it to do and turning back isn't one of its options.

Regards!

...JRF...

[himacs]

Hi James,

thanx for ur reply.

So deleted files are not recoverable..?
no such recover tools vailable in unix..

regards
himacs

[James R. Ferguson]

Hi Himacs:

> So deleted files are not recoverable..?
no such recover tools vailable in unix..

If you delete (remove) a file that is still open (in-use) by a process then you have a better opportunity to recover it, at least in Linux and/or Unix flavors with a '/proc' filesystem. That isn't HP-UX, though.

You might be able to salvage some of the data if your filesystem isn't actively changing by using 'dd' to read the whole filesystem and something like 'grep' to identify potential blocks of data.

Again, you should consider the file lost. But then, you have a backup, don't you?

Regards!

...JRF...

[Bill Hassell · Accepted solution]

> I believe if we recover deleted inode ,we can recover files of that inode.

You are thinking about Windows filesystems where files aren't deleted at all but simply renamed. Unix inodes are simply a collection of data about space on the disk and then the inode is marked as empty, the details are erased. The data is still on the disk but you would have to examine millions of bytes of data looking for a pattern that you know is in the deleted file. If you don't know what the data contains, the file is not recoverable.

Even if you know the patterns found in your file, you have to immediately shutdown your system to prevent any new files from clobbering your deleted file -- that file is empty space for the filesystem. This is also true for Windows but since these boxes don't often have 50 users and several hundred processes.

[himacs]

HI James,BIll

Thanx for the information..

points assigned...



regards
himacs