Re: recover file after cat /dev/null > file

[Jim Cistaro <jim.cistaro@xxxxxx>]

The file is large ~8GB.
By catting the partition I could determine the offset of the start of 
the data for the first inode.

Would this help.
Can you point me to any documention that might discuss this?

Thanks,
JIm
---

Steve Lord wrote:

> > if /dev/null has been catted over an existing file,
> > is there any way to recover data based on inodes (or anything else)?
> >
> > Nothing else has been written to disk since so data should still exist.
>
> Yes, but the tricky part is where. You overwrote the inode and
> freed it's extents, the data is somewhere in the freespace on
> the filesystem, but locating it is not going to be easy.
>
> Unless the file was very large, or the filesystem fairly full,
> the chances are the data is located in the same allocation
> group as the inode, but really I cannot tell you more than
> that.
>
> Sorry
>
>   Steve


--

Jim Cistaro - jim.cistaro@xxxxxx <mailto:jim.cistaro@xxxxxx>
Senior Engineer - AltaVista Company <http://www.altavista.com>
w: 650-320-6340
c: 650-444-8385 
<http://messaging.nextel.com/cgi/mPageExt.dll?action=send&newnumber=6504448385>