On Tue, Mar 13, 2007 at 04:08:25AM +0100, Sebastian Rother wrote:
> Hello everybody,
>
> I`ve a ccd wich contains sensetiv data.
> The Server crashed for technical reasons.
> After it booted up again it told me to do a fsck.
> I did.... and the data is gone now.
>
> --
> fsck /dev/ccd0c
> ** /dev/ccd0c
> ** Phase 1 ..
> ..
> ..
> ..
> ..
> ** Phase 5 - Check Cyl groups
> 1 files, 1 used, 211389152 free (16 fags, 26423642 blocks, 0.0%
> fragmentation)
>
> MAKE FILE SYSTEM CLEAN? [Fyn?]: y
>
> I think I shouldn`t have done it.... is there ANY way to restore this
> file? I didn`t exspected that the fsck would be responseable for any
> dataloss so does somebody know a method to restore this big file?
>
> Further informations: FS at the ccd was UFS/FFS
If you didn't get any questions, it's doubtful that the kernel would
have fared much better than fsck. You could, however, have pointed fsck
at an alternate superblock, and would most likely have been fine.
However, it's a bit late for that, so you'll have to try something
different. I've recently used the sleuth kit from ports to recover data;
it's not trivial to use correctly and costs a lot of time even in those
cases where it works, but if you combine it with some scripting, it's
actually quite useful for data recovery (as opposed to forensics, its
official goal in life). I ended up writing a script to feed the contents
of an inode to less and then basically ask 'restore [yn]'; I just
looked, but it appears I don't have it around anymore.
Alternately, if the amount of data you need to recover is small and you
already know a little piece, simply feeding everything to hexdump | less
might work, too.
As to good advice that's not really useful to you here and now: you
should, of course, have had a backup. Also, while we're on the subject,
don't use the c partition; create a proper disklabel and use /dev/ccd0a,
it's tidier at the least and might actually help in one or two cases.
Joachim
