I just made a quick update to findbill, a simple Perl program that scans a disk to find where backup UFS superblocks are. Most of the time sysadmins use "newfs -N" for this - however if you have tuned file system parameters "newfs -N" doesn't always work.
The output now includes information from the superblocks: last write time and mountpoint, if available. This should help identify what are false positives - such as older superblocks from a previous filesystem that haven't been overwritten.
# findbill /dev/rdsk/c0d0s3
Searching /dev/rdsk/c0d0s3,
Type Block Time last written Mountpoint
UFS 16 Sun Jan 8 16:11:42 2006 /extra1
UFS 32 Sun Apr 17 18:28:54 2005
UFS 32352 Sun Apr 17 18:28:54 2005
UFS 64672 Sun Apr 17 18:28:54 2005
UFS 96992 Sun Apr 17 18:28:54 2005
UFS 129312 Sun Apr 17 18:28:54 2005
UFS 161632 Sun Apr 17 18:28:54 2005
UFS 193952 Sun Apr 17 18:28:54 2005
^C
It's called "findbill" as I've heard the UFS magic number (0x011954, which we scan for) is either Bill Joy's or Marshall Kirk McKusick's birthday (the FFS authors). The UFS cylinder block magic number (0x090255) looks suspicious too.
findbill also identifies superblocks from MTB_UFS - the revamped UFS for the world of terabyte filesystems (UFS lives!).
No comments:
Post a Comment