On 26.03.2009 15:41, Chris Allen wrote:
> In a nutshell, I did the following:
> 1. dd if=some_filesystem_dump of=some_file (where some_file resides on
> an XFS filesystem and is 3.5TB large)
> 2. losetup /dev/loop0 some_file
> 3. mount /dev/loop0 /recovered
> [.... i can now access my recovered filesystem through /recovered ...]
> 4. rm some_file (remotely via an nfs export) (oops!)
> So, I just removed my 3.5TB file even though it is attached to the loop
> device and mounted (XFS did this almost instantly).
> Now it *appears* that the filesystem as attached to /dev/loop0 and
> mounted on /recovered is still OK. I
> can cd around it and copy files off.
> So I have these questions:
> 1. Is there any way I can get back the 1 file that I accidentally
> deleted (nothing else has been written to that partition since)
Unfortunatly not directly. You can't create a directory entry for an
inode. It was discussed a few years back, but rejected for security
reasons. (I speak for the kernel in general, i don't know if there is a
XFS specific thing to create a directory entry for an inode.)
> 2. Am I safe in accessing my filesystem through /dev/loop0 and
> /recovered even though the underlying file has been zapped? If so
Yes. You are saved by the standard unix semantics of "only delete a file
if it's reference count is 0". A directory entry counts and having a file
open also counts.
> I can quickly copy everything off onto another partition.
As long as you don't reboot/umount the partition you are in no hurry.
Only Murphy can really ruin your day now. ;-)
> 3. Will this command: dd if=/dev/loop0 of=saved_file get my file back?
- You should drop the caches before starting the copy:
echo 3 > /proc/sys/vm/drop_caches
- You should not touch the filesystem while copying. Especially you
shouldn't write anything. The "view" of the upper- and underside
(Filesystem vs. backing-store) are NOT kept in sync by the kernel. So it
is best not to touch the filesystem.
You can also:
xfs_freeze the filesystem (see man xfs_freeze)
or umount the filesystem if the entry in "/etc/mtab" does NOT mention
"loop=/dev/loop<whatever>" or if you delete if before umounting.
Because umount will only free the loop-device if there is a "loop=" or
with the parameter "-d" (see man umount)
Real Programmers consider "what you see is what you get" to be just as
bad a concept in Text Editors as it is in women. No, the Real Programmer
wants a "you asked for it, you got it" text editor -- complicated,
cryptic, powerful, unforgiving, dangerous.