file recovery

[Tim Nelson]

Here is a good one for the experts. I have a file that was deleted with rm. The file was still being used by a process so I know it is still out there. bdf still shows the correct used space as if the file was still there. A ls shows that it is gone. If I do a dd of the logical volume I can still see the data so I know it is still on the disk only the inode reference is gone. Does anyone know of a way to modify the inode with something like odb or some other way to recover the entry for this file ? This is a vxfs filesystem. This is not critical and I can restore from tape if needed but I would like to play with this.. Thanks to anyone with suggestions of recovering other than doing a restore from tape.
I did already try to dd the info from one disk to another but got the same results.
Fun Fun...

[Patrick Wallek]

I don't know if this will help you or not, but check out this article from Sys Admin magazine:

http://www.samag.com/documents/s=1441/sam0111b/0111b.htm

If this works, great. If not, well, you tried.

Other than this possibility, I can't think of any other way to recover a file once you have executed rm. Unfortunately there is no unrm utility other than restore from a backup.

Good luck.

[Sanjay_6 · Accepted solution]

Hi,

At times like this we wish hp would learn to put a recycle bin like microsoft and add a undelete command.

Thanks

[Helen French]

Hi,

As far as I know, you won't be able to 'unrm' that file. You may need to retrieve it from the backup. You may set an alias 'rm -i' inorder to avoid accidental deletion of files.

HTH,
Shiju

[Bill Hassell]

man fsdb

This command must be run by root and can do anything you want to the filesystem.

WARNING: You can do anything you want to the filesystem!

Like adb and other lowlevel tools, a detailed knowledge of the filesystem design is necessary to use the tool. man fsdb is the 'wrapper' page so for details, you'll have to use man fsdb_vxfs or man fsdb_hfs.

Good luck (you'll need it).

Note that a few years ago, Norton provided an unremove utility--it was shortlived. Essentially, it worked exactly like the Recycle Bin...move the file rather than remove the file. Works fine until the file you want removed is 900 megs...

[Tim Nelson]

Thanks all... I was going down the path of fsdb and just researching inode and file layouts for the vxfs systems. If I get anywhere I will let you know. Again this is more for fun / experience..

Any comments or sources for fsdb would be appreciated.

[Helen French]

Hi Tim,

Check this out for useful information about fsdb:

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90681/B2355-90681_top.html&con=/hpux/onlinedocs/B2355-90681/00/01/107-con.html&toc=/hpux/onlinedocs/B2355-90681/00/01/107-toc.html&searchterms=fsdb&queryid=20020103-122812

HTH,
Shiju