Re: deleted files are empty?

Benjamin,

Benjamin Morin wrote:
> A [stupid] user has rm -rfed a directory. I've unmounted the disk
> immediatly, then remounted-it read only. I have tried to recover the
> deleted files using icat, but ils tells me that all the deleted files
> are empty (size=0). The box is a Solaris 8, and the file system is ufs.
> Any idea?

this is a feature, not a bug :-) Solaris like *BSD sets file
size and block pointers (i.e. disk block numbers inside the inode
pointing to the actual data on disk) to *zero*, thereby
effectively rendering icat unusable. See page 4 of
http://www.cerias.purdue.edu/homes/carrier/forensics/docs/autopsy_sansfire2001.pdf

What you can do is use unrm (tct) or dls (sleuthkit) to
retrieve all disk blocks marked as free and then e.g. use lazarus
to find the data you are looking for among those blocks. This may
take quite some time and effort, since lazarus may run for quite some
time trying to classify your "undeleted" blocks and then you have to
do quite some work looking at the results, so I would only do this if
the data was worth at least two or three days of my time...

In general chances for recovering data are not too bad, because 1) ufs tries
to allocate data on disk as sequential as possible 2) you unmounted
right after the incident, so chances that these blocks were overwritten
by other data are pretty small.

Good luck,

Knut