VMS-undelete

[Mrityunjoy Kundu]

Hi,

How can i recover files after it is deleted.
Here in this scenario ,OPENVMS 7.3-2 is running on alpha server (ES45).One guy in our territory deleted some very important files,by mistake.We have no backup of those files.

Please help.

[Volker Halle]

Write-protect the disk immediately. Do NOT create any new files on that disk.

Make a BACKUP/PHYSICAL from that disk before you try anything else.

Then look around for some tools to help you...

There is no UNDELETE command in OpenVMS.

Volker.

[Karl Rohwedder]

After following Volkers advice you may try the DFU utility (found e.g. at http://www.digiater.nl/dfu.html), which allows for undeletion:
$ MCR DFU UNDELETE SYS$DISK/FILE=...

see MCR DFU HELP 1st.


regards Kalle

[Mrityunjoy Kundu]

volker,

what type of tools you suggest & what do u maen mean by write protected this disk...Is that mount that disk with foreign qualifier

[Ian Miller.]

The DFU utility does have an undelete command but you must stop using that drive and perform the backup/physical as already advised.

[Volker Halle · Accepted solution]

If you leave this disk MOUNTED system wide and applications still write to that disk, the chances are very high, that the blocks previously owned by the 'deleted' files have already been overwritten and there is NO WAY to recover the data.

Dismount the disk, use MOUNT/FOR/NOWRITE and make a physical backup first. Then start to think about recovery.

Volker.

[Shailender_1]

You can try the attached undelete.exe. Define it as foreign command

Use: $ UNDELete disk:filename ! puts it into original directory
c $ UNDELete disk:[dir]filename ! puts it in [dir] if it exists
c Disk must be mounted Files-11.

[Shailender_1]

Follow Volker first then test the utility first before running for actula files.

[Dean McGorrill]

mrityunjoy,
follow volkers advice before doing anything!

re ;-1
A handy little tool, though I wonder how
it would work on a busy disk. if you know exactly what you deleted, version number etc. and other same named files don't exist
do you have the sources for that? I'd feel
safer running it, by looking at the code.

heres a test on a test disk - it might
help him..

$ del time.exe;
$ dir time
%DIRECT-W-NOFILES, no files found
$ show default
DISK$DEAN_LAUREL:[MCGORRILL]

$ undelete DISK$DEAN_LAUREL:[MCGORRILL]time.exe
Opening index file and bitmap on DISK$DEAN_LAUREL:
Attempting to recover TIME.EXE and place it in directory [MCGORRILL]
Continue? (Y/N) y
253 blocks read from storage bitmap
Reading home block on DISK$DEAN_LAUREL:
Disk is Files-1 ODS-2 version 1
Cluster size is 69
Maximum number of files is 507690
Index file bitmap starts at VBN 277 and goes on for 124 blocks
File headers start at VBN 401
Filename: TIME.EXE;8
VBN 8166: FID( 0 2 0) EXT( 0 0 0) CHAR 00008020 CHECK 0000
Recover this file? (Y/N) y
Rewriting file header for TIME.EXE;8
VBN 8166: FID( 7766 2 0) EXT( 0 0 0) CHAR 00000020 CHECK 84A2
Entering file into directory FID ( 7757 1 0)
Created TIME.EXE;8

Checking bitmap for allocation of blocks...

Count Start Retrieval pointer
69 4330716 8044 14DC 0042
Rewriting affected blocks in BITMAP.SYS: 1 to 16

Recovered 1 blocks
FILE AND DISK HAVE BEEN RECOVERED INTACT
$ dir time

Directory DISK$DEAN_LAUREL:[MCGORRILL]

TIME.EXE;8 9/69 12-JUN-2007 10:21:39.29 [DEVELOPMENT,MCGO
RRILL] (RWED,RWED,RE,)

this image ran fine. though the tool could
use some work...

$ anal/disk/repair disk$dean_laurel
Analyze/Disk_Structure/Repair for _$1$DKC204: started on 3-JUL-2007 15:19:53.13

%ANALDISK-I-OPENQUOTA, error opening QUOTA.SYS
-SYSTEM-W-NOSUCHFILE, no such file
%ANALDISK-W-FREESPADRIFT, free block count of 65586225 is incorrect (RVN 1);
the correct value is 65586156
$ write sys$output 65586225 - 65586156
69
$

as I said, the tool needs some work but got
my file back ok. This might help him, perhaps run it on a copy of the copy.
sources? maybe we could tidy it up -Dean