Perl Disk Block Searching Utility

One of things that happens to me every once and a while is that I fat-finger a move or copy and blow away an important file from disk. If you use emacs (or other text editors which leave backup copies) there actually should be many copies of the file on disk, even if the last copy got overwritten or the directory has lost it. The trick is to find these backup copies.

The following recover utility is a perl script that I have used over the years to search through the blocks on disk to find files that I've blown away. Basically it reads in the disk blocks and looks for regular expression patterns that are specified on the command line -- a block must match all of the patterns before it is considered a match. The hardest part of the process is thinking of a pattern that uniquely (as much as possible) matches a particular file that you are trying to find. If the script finds a block that matches, it will dump X blocks before the matching block and Y blocks after the match. These values are tunable at the top of the script. This doesn't really "undelete" the file but it should give you portions of the file with which you can reconstruct some of your work.

WARNING: you must redirect the output to another file-system, to another host via netcat (man nc), or at least through gzip so the script doesn't find some matches and then find the output file in which case it will go recursive and fill the disk. It is also a good idea to redirect to another file-system or off the box so you don't write over more disk blocks, possibly overwriting the copy of the file you need.

Download latest copy of the script:

recover.pl perl script (text version)

Usage examples:

# The pattern 'sendmail_pid' (for example) matches the script I blew away # /dev/md0 is the device of my main drive which could also be a normal file, /dev/sda1, /dev/disk0s2, or ... # piping to netcat to send it to another server perl recover.pl sendmail_pid /dev/md0 | nc server1 5000 # or piping to gzip to avoid the recursion perl recover.pl sendmail_pid /dev/md0 | gzip -9 > hopeful.gz

One more thing. Now that you are tearing your hair out, it might be a good time to invest in a backup strategy. You can take a look at my content based perl backup scripts as a possible solution.

Free Spam Protection   Eggnog Recipe   Android ORM   Simple Java Magic   JMX using HTTP   OAuth 2.0 Simple Example   Great Eggnog Recipe   Christopher Randolph