Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!ames!sun-barr!apple!ric
From: ric@Apple.COM (Ric Urrutia)
Newsgroups: comp.unix.questions
Subject: Re: Can you recover deleted files in Unix ?!?
Message-ID: <34209@apple.Apple.COM>
Date: 22 Aug 89 16:38:46 GMT
References: <740@ndcheg.cheg.nd.edu> <741@ndcheg.cheg.nd.edu>
Distribution: na
Organization: Apple Computer Inc, Cupertino, CA
Lines: 21

In article <741@ndcheg.cheg.nd.edu> kellow@ndcheg.cheg.nd.edu (John Kellow) writes:
>kellow@ndcheg.cheg.nd.edu (John Kellow) writes:
>
>Well, in answer to my own question - I did recover the important data
>that I had deleted.  I guess the answer would be no, you can't
>"undelete" files in SYSV.2 Unix but you can recover individual blocks
>of data.  It took a few hours of trying to decipher the manuals and
>some trial and error but I think I've got it figured out and its not
>too complicated (someone correct me if I'm wrong).  The actual blocks
>of data are not removed, only the inode entry.  Since the inode entry
>contains all of the information as to what blocks belong to what file
>and in what order, you can't very well "undelete" the file but the
>data might still be there and you can piece it back together by hand.

I have never understood why the entire inode is zeroed out when a file is 
removed.  I believe that a SVFS inode is "free" if the link count is 0.  If
the removal of a file simply made the di_nlink field 0 and left the rest of
the inode info intact, one would have a better chance of "undeleting" a file.  

Granted that if the file is quite large, certain blocks will be lost as they
are allocated for chaining the free list together.