How to recover an overwritten file (sfs)
  • Yokemate of Keyboards
    Yokemate of Keyboards
    Zylesea
    Posts: 2028 from 2003/6/4
    Well, I've somehow managed to overwrite (not deleted) a file with an empty one (1byte). Original file was quite some work that I hadn't backed up for a few weeks (if I don't find a copy on some hidden usb stick). Is there a way to revover the original file? The drive is using sfs.
    --
    http://www.via-altera.de

    Whenever you're sad just remember the world is 4.543 billion years old and you somehow managed to exist at the same time as David Bowie.
    ...and Matthias , my friend - RIP
  • »23.04.12 - 00:39
    Profile Visit Website
  • MorphOS Developer
    itix
    Posts: 1516 from 2003/2/24
    From: Finland
    SFSDoctor?
    1 + 1 = 3 with very large values of 1
  • »23.04.12 - 05:38
    Profile
  • tom
  • Acolyte of the Butterfly
    Acolyte of the Butterfly
    tom
    Posts: 147 from 2003/7/22
    From: Heesch, The Ne...
    Open the partition. Set it to display 'All Files" and then look in '.recycled'.

    good luck....


    Regards, Tom
  • »23.04.12 - 09:16
    Profile
  • Yokemate of Keyboards
    Yokemate of Keyboards
    Zylesea
    Posts: 2028 from 2003/6/4
    In .recycled there are a few files "mru$???", which hold path information about (?)recent files (?) but I don't know what to do with them, among them the path of the overwritten file.

    I guess my prob is that the file was not deleted, but overwritten (I have no clue how that happend, I wasn't actually working on that file, but wanted to open it with Cubic to read it while I played the program with Hollywood). But the new content of that particular file is 1 byte only, hence I think the old content of that file is probably still there somewhere on the disk. I played with sfsdoctor a bit, but haven't found an option to help me in this case.
    --
    http://www.via-altera.de

    Whenever you're sad just remember the world is 4.543 billion years old and you somehow managed to exist at the same time as David Bowie.
    ...and Matthias , my friend - RIP
  • »23.04.12 - 10:30
    Profile Visit Website
  • Order of the Butterfly
    Order of the Butterfly
    Divinity
    Posts: 496 from 2009/9/8
    interesting question
  • »23.04.12 - 11:32
    Profile
  • MorphOS Developer
    Piru
    Posts: 533 from 2003/2/24
    From: finland, the l...
    As far as I can tell overwriting doesn't create a .recycled entry. SFSDoctor won't help you if the file was overwritten normally.

    Your only chance is to locate the file contents on the physical disk. You likely have lost at least first blocksize (default 512 bytes) amount of the data though.

    I'd use USB<->IDE device to connect the HDD to a linux box and use 'dd' to clone the disk to a file. Once done you at least have something safe to work with.

    I'd likely use some hex edit tool with a search on the dumped image file. This of course assumes you know some unique strings or hex pattern inside the file you can search for. Note that this method is likely going to find multiple dupes of the same content, likely different revisions of the same work.

    I wish there were an easier/better way to do it, but I can't think of any.

    [ Edited by Piru 23.04.2012 - 21:42 ]
  • »23.04.12 - 22:40
    Profile
  • Yokemate of Keyboards
    Yokemate of Keyboards
    Zylesea
    Posts: 2028 from 2003/6/4
    Thanks for your ideas. Seems the smaller effort will be to rewrite the stuff again. I think I lost work of a few (not many) evenings and a few ideas I noted there.
    Well, let's take this as another reminder to just keep better track of security copies - laziness in that regard comes over time when everything goes well...
    --
    http://www.via-altera.de

    Whenever you're sad just remember the world is 4.543 billion years old and you somehow managed to exist at the same time as David Bowie.
    ...and Matthias , my friend - RIP
  • »23.04.12 - 22:53
    Profile Visit Website
  • Order of the Butterfly
    Order of the Butterfly
    igracki
    Posts: 375 from 2003/2/25
    From: Berlin
    Could it be added to sfs (or ice) that on overwriting a file an entry in the recycled dir is created?
  • »24.04.12 - 15:36
    Profile Visit Website
  • Acolyte of the Butterfly
    Acolyte of the Butterfly
    Leif
    Posts: 111 from 2006/5/31
    From: Sweden
    Quote:

    Could it be added to sfs (or ice) that on overwriting a file an entry in the recycled dir is created?


    AFAIK both SFS and IceFS do recycle files when overwritten
    using the MODE_NEWFILE mode. Many applications use
    MODE_READWRITE, followed by setting the filesize to 0
    instead, which is not recycled, probably because it is a bit
    more work to make this work in the filesystem. And no other
    filesystems support it either. But I'll see if it can be
    added to IceFS in future. It was on my mind once, but more
    important stuff came up.
  • »24.04.12 - 16:02
    Profile