Re: UPDATE: low-level XFS drive recovery

[Nathan Straz <nstraz@xxxxxxx>]

A few months back I repartitioned a BSD box before I realized that I
lost my backups.  The tool that helped me recover most of my data was
Python.  Why Python?

 - Interactive scripting language

      With an interactive scripting language you can write the tools
      while you use it.  I can paste functions in from an editor, try
      them out, fix the bugs in the editor and repeat.

 - the struct package

      Python has a package that takes strings and unpacks them into
      variables.  I've used it to decode everything from superblocks to
      dentries.  
 
 - the mmap package
 
      mmap your entire disk image read-only and access it like an array.
      You can then use slices and regex on it to find where structures
      are.  

If you want, I can send you my code as a starting point.  It's for
OpenBSD (4.4BSD UFS), but it should give you some ideas.

-- 
Nate Straz                                              nstraz@xxxxxxx
sgi, inc                                           http://www.sgi.com/
Linux Test Project                                  http://ltp.sf.net/