[vox-tech] Recovering data

[Mike Simons]

On Mon, Mar 17, 2003 at 04:30:20PM -0800, Michael J Wenk wrote:
> The system is running samba 2.2.3a.  There is nothing useful that I can see
> in any samba logs.  I did notice something I was unaware of, the laptop that
> I call buffy was not in my static DHCP table, ie, it is getting various IP
> addresses and names.  I wonder if that could have an effect?  

  It is highly unlikely that the Dynamic IP had anything to do with this.

  It sounds like the backup software you used overwrote the file, I would
recommend checking the timestamp on the tiny file to see when it happened.
(after the first restore, or during the second backup, etc).

> I went thru
> the filesystem that I stored the backup on and tried to search for the file
> with debugfs, but either because the file was too large(recover segfaulted
> on me) or some other reason.  Ive tried the tricks I know to recover a file,
> and have failed, so Ive pretty much given up on my data, but ANY help would
> be greatly appreciated.

  It is too late, but unmounting the partition as soon as you realize
something is wrong decreases the chance of future file system activity 
damaging your file data, wherever it is on the filesystem.  

  One problem you may have 'rm file' is very different from 'echo > file'
in that one unlinks the file so that it's inode is intact but not attached...
the echo on the otherhand truncates the file (releasing all the blocks 
that are part of the inode), and reuses the inode for the new file contents.
>From what I understand debugfs utils can reattach unlinked inodes, but 
once the blocks are not recorded as part of an inode, trying to figure out
what blocks were part of what file and in what order is kinda tough.

  If you value the information greatly, doing a lowlevel partition backup
(like 'dd if=/dev/hdb1 of=/big_place/hdb1.img' style) then contacting some 
people doing ext2/3 filesystem development is your best chance.

    Good Luck,
      Mike Simons