Recovering deleted files using only grep
blog.nullspace.io
Recovering deleted files using only grep
1–10 of 46 posts
Re: Recovering deleted files using only grep
#2Recovering deleted files on ext3/4 systems using either file-format-matching tools or the journal http://linux.sys-con.com/node/117909 (also https://wiki.archlinux.org/index.php/File_recovery)
Re: Recovering deleted files using only grep
#3A very important lesson regarding the Unix principles of "everything is a file" and programs that "do one job well".
Re: Recovering deleted files using only grep
#4I guess it's a good thing he didn't have an SSD and TRIM enabled!
Re: Recovering deleted files using only grep
#5A very important lesson regarding the Unix principles of "everything is a file" and programs that "do one job well".
It's kind of flawed where he says " If you pick x to be big enough, you should get the entire file, plus a bit of junk around the edges." - because this is simply not how filesystems work - if you manage to get the full file, it's by luck that it was small enough for the filesystem to allocate its contents contiguously on the block device.
Anything bigger and you're gonna quickly need something more sophisticated which can understand the filesystem it's dealing with, as it will need to collect the many pieces of your deleted file scattered across the block device and merge them. I'm sure that would be mountains of fun to do with bash.
And in this case, the "do one job well" program that you're gonna need is a program which specifically recovers deleted files from a specific filesystem.
Re: Recovering deleted files using only grep
#6A very important lesson regarding the Unix principles of "everything is a file" and programs that "do one job well".
It's kind of flawed where he says " If you pick x to be big enough, you should get the entire file, plus a bit of junk around the edges." - because this is simply not how filesystems work - if you manage to get the full file, it's by luck that it was small enough for the filesystem to allocate its contents contiguously on the block device. Anything bigger and you're gonna quickly need something more sophisticated whi…
I'm the author of the post -- that's good to know, thanks! :) I know embarrassingly little about filesystems. I'm glad you pointed this out.
EDIT: though, I'd point out that if you really wanted to recover the file you should probably try to use /proc or something (at the time I didn't know about this). This approach requires crawling the disk which is obv pretty slow. :) It's less of a "here's a useful thing" and more of an excited "HEY DID YOU KNOW THAT YOU CAN DO X".
EDIT 2: I updated the blog to link to your comment, because it's baller.
Re: Recovering deleted files using only grep
#7I'm wondering a lot why it's 2014 and https://gist.github.com/llelf/7862414 (it's hammerfs on DragonflyBSD) is WOW (and not some ordinary boring thing everyone use)
Re: Recovering deleted files using only grep
#8I'm wondering a lot why it's 2014 and https://gist.github.com/llelf/7862414 (it's hammerfs on DragonflyBSD) is WOW (and not some ordinary boring thing everyone use)
parse error
Re: Recovering deleted files using only grep
#9A very important lesson regarding the Unix principles of "everything is a file" and programs that "do one job well".
go find solace with plan9
Re: Recovering deleted files using only grep
#10I'm wondering a lot why it's 2014 and https://gist.github.com/llelf/7862414 (it's hammerfs on DragonflyBSD) is WOW (and not some ordinary boring thing everyone use)
Yep.. installed Dragonfly last week on my home server, the concept of virtual kernels and Hammerfs was the selling point for me, +1 for you sir.