Re: What is the best way to look for a lost file in the disk blocks

On Wed, Aug 10, 2022 at 3:55 AM David Christensen
<dpchrist@holgerdanske.com> wrote:
>
> On 8/9/22 05:23, Matthias Apitz wrote:
> >
> > Hello,
> >
> > Last night I damaged a plain UTF-8 HTML file (I copied by accident a
> > JPEG file over it) and it turned out that the backup was done a month
> > ago. I learned my lesson from this re/ doing backups more often of files
> > I'm working on...
> > Maybe there is a chance that the disk blocks are still not overwritten,
> > what would be the best way to look for them block by block and if it
> > contains certain string "foo-bar" having the block number from the
> > beginning of the device to get it back with dd(1) into a file. Any
> > scripts or tools for this?

if this is UFS, IME you're out of luck, as overwrite really means
overwrite (but perhaps things have progressed more since I had any
detailed dealings with UFS).
If this is ZFS, ZFS's copy-on-write semantics may get you lucky ...
I once searched for and used a tool that scans a complete (unmounted!)
disk and produces "most likely" files - that was FAT though, don't
know if such tools exist for other file systems. I'm afraid I don't
have the name of the tool handy.

HTH
Michael

>
>
> You might be able to find raw blocks with grep(1) and/or Perl:
>
> https://unix.stackexchange.com/a/710673
>
>
> But, I do not know how UFS chains together blocks to form a file.
>
>
> David
>
>
> p.s. If you put your development directory on ZFS, you can use
> zfs-auto-snapshot to take snapshots on whatever schedule you want.
>


-- 
Michael Schuster
http://recursiveramblings.wordpress.com/
recursion, n: see 'recursion'