If anyone at Sun or other vendors wants to pass this along, one small
and I believe harmless change in the file system would make recovery
much, much easier: Don't zero out the block pointers in the inode or
the mode when a file is deleted, use some other indicator, like
setting the access time to 0xFFFFFFFF or some such thing (or maybe set
the number of blocks held to zero, whatever.)
Then again, one person's feature is another's security hole. I could
see arguments why you wouldn't want to make it too easy to recover
deleted files. Obviously fsck would need to be changed a little also.
Folks, if you find yourself in this situation, hit the power button or
L1-A the sucker, bring it back up single user, and dd the partition to
tape before mounting or anything. Fsck will clean up the mess if need
be, it's the least of your problems if you've really wiped a disk full
of valuable, unbacked-up files. And don't expect miracles.
Better yet, do regular backups, but you knew that already...ya can pay
now, or pay later...
-Barry Shein
Software Tool & Die | bzs@world.std.com | uunet!world!bzs
Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD
This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:06:17 CDT