FFSRECOV(1)

NAME
ffsrecov - aid to recover files from corrupt ffs filesystems

SYNOPSIS
ffsrecov [-adps] [-b blk] [ -c inum -n name | -f inum | -i inum] [-o blk] [-r name] [-t blk] file

DESCRIPTION
The program ffsrecov is used to aid in the recovery of file data from a corrupt file system.

The options are as follows:

-a  Dump all files on the filesystem that have the mode IFREG in the inode. They will be put into the local directory with their name being the inode number.

-b blk
    Find where block blk is in the file system. This will report what file if any it is in, or if it is in part of the meta data in the file system. NOTE: This is experimental and hasn't been fully tested.

-c inum -n name
    Recreate inum in the current directory with the name name. If inum is a directory, it will create the directory, and populate it with it's children. This will restore permissions, ownership (if root), atime and mtime.

-d  Dump all the inodes with the mode IFDIR. The listing will contain each file name and inode number that goes with the file. Each directory is listed on a single line.

-f inum
    Print out inode information for inum.

-i inum
    Dump out the data belonging to inum to stdout.

-o blk
    Use disk block blk as the location of the superblock. Currently this only effects the parameters used, or what is printed out when displaying the superblock with -p. It does not change where it thinks the blocks within the file system are.

-p  Print out the information contained in the superblock.

-r name
    Prints out the inode and the parent inode of any file that matches name.

-s  Find possible superblocks in the filesystem. If there is a valid cylinder group following it, it will print out where the beging of the file system is. This may not be correct if there are stray superblock/cylinder group pairs on the disk, such as in swap.

[-t blk]
    Offsets all read operations to blk. This is useful for accessing a filesystem in another partition through the raw disk device that covers the entire disk. The other block offsets are all relative to this. Reported blocks will also be relative to this block offset.

file
    Operate on the file system file. This file can either be a raw device or a regular file. You must either be able to mmap(2) or be able to seek on it.

EXAMPLES
The following is an example of a typical usage of the ffsrecov command:

If you would like to recover inode 2385 named dir and all it's decendants the command:

    % ffsrecov -c 2385 -n dir ffs.image

will create dir, populate it, setting modes, permissions, and times to the originals.

    % ffsrecov -s /dev/rda0c

will scan the entire disk da0 and search for possible file systems. It will print out the super block offset (for use with -o) along with the start of the file system.

    % ffsrecov -p -o 655376 ffs.image

will print out the super block at disk block location 655376. It will warn if the block doesn't appear to be a valid super block, but will still try to print out parameters from it.

AUTHORS
This manual page was written by John-Mark Gurney <jmg@FreeBSD.org>.

BUGS
The code doesn't handle triple indirect blocks. This shouldn't be a problem due to the fact that on a standard 4096/512 system, you can represent a 2**32 byte file without triple indirect blocks.