Well, I've somehow managed to overwrite (not deleted) a file with an empty one (1byte). Original file was quite some work that I hadn't backed up for a few weeks (if I don't find a copy on some hidden usb stick). Is there a way to revover the original file? The drive is using sfs.

SFSDoctor?

Open the partition. Set it to display 'All Files" and then look in '.recycled'.

good luck....


Regards, Tom

In .recycled there are a few files "mru$???", which hold path information about (?)recent files (?) but I don't know what to do with them, among them the path of the overwritten file.

I guess my prob is that the file was not deleted, but overwritten (I have no clue how that happend, I wasn't actually working on that file, but wanted to open it with Cubic to read it while I played the program with Hollywood). But the new content of that particular file is 1 byte only, hence I think the old content of that file is probably still there somewhere on the disk. I played with sfsdoctor a bit, but haven't found an option to help me in this case.

interesting question

As far as I can tell overwriting doesn't create a .recycled entry. SFSDoctor won't help you if the file was overwritten normally.

Your only chance is to locate the file contents on the physical disk. You likely have lost at least first blocksize (default 512 bytes) amount of the data though.

I'd use USB<->IDE device to connect the HDD to a linux box and use 'dd' to clone the disk to a file. Once done you at least have something safe to work with.

I'd likely use some hex edit tool with a search on the dumped image file. This of course assumes you know some unique strings or hex pattern inside the file you can search for. Note that this method is likely going to find multiple dupes of the same content, likely different revisions of the same work.

I wish there were an easier/better way to do it, but I can't think of any.

[ Edited by Piru 23.04.2012 - 21:42 ]

Thanks for your ideas. Seems the smaller effort will be to rewrite the stuff again. I think I lost work of a few (not many) evenings and a few ideas I noted there.
Well, let's take this as another reminder to just keep better track of security copies - laziness in that regard comes over time when everything goes well...

Could it be added to sfs (or ice) that on overwriting a file an entry in the recycled dir is created?

Quote:

AFAIK both SFS and IceFS do recycle files when overwritten
using the MODE_NEWFILE mode. Many applications use
MODE_READWRITE, followed by setting the filesize to 0
instead, which is not recycled, probably because it is a bit
more work to make this work in the filesystem. And no other
filesystems support it either. But I'll see if it can be
added to IceFS in future. It was on my mind once, but more
important stuff came up.