Zero Byte File

[rbrooks]

Hello, I have FreeBSD 8.2 running on a Dell server with 3 physical disks in RAID 5. I have a python source file called xxx.py (about 20K) that apparently got overwritten with a zero byte file. I've turned the box off immediately to keep more data from being written to disk. Is there anyway to recover this file or the data in it? I can remember exact strings in the file to search for if there was a utility I could examine hex bytes or something. I'm guessing the data is still on the disk but I'm not sure how to get at it. Any help/suggestions appreciated.

 

[SirDice]

Hello, I have FreeBSD 8.2

Please plan an upgrade to 8.3, FreeBSD 8.2 is End-of-Life.
http://www.freebsd.org/security/#unsup

Is there anyway to recover this file or the data in it?

Yes, restore the file from backup, you do have backups?

 

[fluca1978]

I can remember exact strings in the file to search for if there was a utility I could examine hex bytes or something. I'm guessing the data is still on the disk but I'm not sure how to get at it. Any help/suggestions appreciated.

Uhm...I guess it is worth using a backup copy. First the recovery tool depends on the file system you are using (e.g., ZFS - maybe a snapshot?). After that it depends on what did overwrite the file: if the file has been truncated chances are the data is still there, but if it has been erased and trimmed then there is nothing to do. Moreover, even if the file is small, chances are that the raid 5 has striped the data block across disks, and therefore that not all the zeroing has been applied to the same extent (since you shout down the machine, even if I believe your fast finger cannot compete with trimming a 20k file...).
Maybe diskrecover could help, it should be in the ports.

 

[MorgothV8]

I had this problem few times.
For text files I was ALWAYS successful, for small (really small) images et I had some successes, but bigger files like MP3/OGG or movies was lost.

I used my own written program, and disk with lost file was never mounted RW until I recovered what was needed.
I had to merge some 4K blocks manually with VIM later, but as far as this is TEXT file, I cound restore all - for example some day I lost rayslib.c (my raytracer library) I was working on it for about 3-4 days (I had so old backups), and then I recovered this file (about 300 Kb size)