Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!tut.cis.ohio-state.edu!gem.mps.ohio-state.edu!ginosko!uunet!virtech!cpcahil
From: cpcahil@virtech.UUCP (Conor P. Cahill)
Newsgroups: comp.unix.wizards
Subject: Re: Is there an FSDB Manual?
Message-ID: <1257@virtech.UUCP>
Date: 11 Oct 89 02:11:33 GMT
References: <82@olsa99.UUCP> <4420001@hpgnd.HP.COM>
Organization: Virtual Technologies Inc
Lines: 42

In article <4420001@hpgnd.HP.COM>, chris@hpgnd.HP.COM (Christian LOTITO) writes:
> 
>  Is fsdb able to "undo' an rm ?

No and yes.  fsdb does have the capability to make all of the modifications
to the file system to "create" a new file out of blocks of information from
a previously removed file, however due to UNIXs cleaning up after itself this
is not a real option.

The problems you would run into in trying to do this would include:

	1. The inode number in the directory is cleared, so you don't know
	   what inode the file used.  

	2. If you by some unknown reason, know the inode number that the 
	   file had used, it wont help because the inode is cleared and all
	   of the block addresses are set to 0 (and indirect blocks are 
	   returned to the free list).

	3. If, by some unbelievable stroke of luck, just happen to have 
	   recorded the blocks used by the file on a scrap of paper next to
	   your terminal, you will still have a problem as the kernel wrote
	   the free list linkage info into the data blocks (I *think*).

	4. If you are able to reconstruct this far, then you are a miracle
	   worker and won't need to worry about what the actual size of the
	   file was (since that info is also lost from the inode and the 
	   file was probably not a multiple of a block).
	

Thats all I can of off of the top of my head.  Oh yeah, being able to do
even this, relys on the fact that the file system the file in question
resides on is quiet from the time the file is removed to the time you
are trying to restore the file.

Good luck

-- 
+-----------------------------------------------------------------------+
| Conor P. Cahill     uunet!virtech!cpcahil      	703-430-9247	!
| Virtual Technologies Inc.,    P. O. Box 876,   Sterling, VA 22170     |
+-----------------------------------------------------------------------+