Recovery and repair of UFS Directories

[cynjut]

I've been working from my backup all week-end and I need some help figuring some things out. I've got a directory I'm trying to recover. Here's a picture:

(R-TT-1)

The ones with no marks recover fine. The ones with red checks are directories that have been damaged. Here's a picture of what a damaged directory looks like.

(R-TT-2)

There are a couple of things of note here. The first is that the sector immediately above the one I'm working with it garbage data. It's completely hosed, and I have no problem with that. I just go to offset 0 and replace '.' and '..' with appropriate values and the directory becomes accessible.

Now, take a look at R-TT-1 again. Note that there are holes in the date list. Here is some detail from the directory list.

(R-TT-3)

In the middle of the screen, you see the directory entry for 20080827 at the start of sector at offset 1800. If you look in the first list, 20080827 isn't there. Let's look specifically at the entry for 20080908. The I-Node number looks good, there is nothing in the previous entries that would keep the entry from showing up in the directory list (I'd rather see it there with a 'skull and crossbones' or a black 'x' than not show it. The biggest problem I have is if you go to the I-Node in question, the directory structure is there and all of the files appear to be in the directory. Since the information is clearly there in the directory tree, you should recognize that and put it in the listing. Mark it with a Red X or a flashing question mark or something, but don't just leave information off that is this important.

Until I get the system to put that directory up on the screen, I can't recover it. The scan tools just aren't doing it for me - they aren't recognizing the dead directory entries and trying to reallocate or recover them. I need to be able to reach out and recover the files myself. BTW - if you are looking for a simple 'directory with files' signature, you can used "xx xx xx xx 0c 00 04 01 2e 00 xx xx xx xx xx xx 0c 00 04 02 2e 2e 00" - the first 4 'xx' entries are the directory I-Node, the '0c 00' is the length of a directory entry. The 04 and 01 are 'dir type' and 'name length' followed by the name '.'. The name is padded out to a null and is a 4 character multiple (including the '00'), so the next two 'xx' entries are 'filler'. We then start over with the next entry (I-Node, entry length, type (4 is directory, 8 is regular file, etc.), file name length (2 for ..) and the null.

These are always at the beginning of the file structure. Arguably, they aren't 'required' to be at the start, but they are required to have a valid directory. If you add this to your scan parameters, you might be able to help a guy out a little. In my case, the 20080908 directory exists quietly on the disk in exactly the right place. I just can't see it.

Your tools allows for the direct editting of disk sectors. If you are going to give people that kind of power, the least you could do is give us all the information available, not just the pretty stuff.

[cynjut]

I can't upload the pictures to show you what I'm talking about. Let me know when that is resolved and I'll post the pictures.

[Alt]

I'll try ti fix the problem.