[NCLUG] aye carumba

[Aaron D. Johnson]

> Well, after 16 years in this industry I did the big no-no. I was
> shuffling directories around and unfortunately had one I needed in
> one I blew away, or at least partially. The needed directory is gone
> as shown via ls, but some other directories in the one being blown
> away still exist as I stopped the rm when I remembered.
> 
> Any thoughts on what I can do besides drown in a pitcher of pin~a
> colada.

Get it off your most recent backup tape.

I'm guessing Solaris doesn't zero out all the deallocated blocks, so
if you know what you're looking for, you can do some addressing by
content.  That is, start grepping for the contents you lost on the
block device the affected filesystem is mounted on.  You stand a
fairly good chance of getting _some_ of it back.  You can tell grep to
print out byte offsets of the stuff it finds and then use dd to
collect the relevant sectors from the block device.  You'll want to
make sure nothing else is happening on that filesystem, too.

Good luck.

- Aaron