Zapped /etc,/bin,/dev ... how to recover user files?

[John Canning]

In article <23092 at ditka.UUCP> kls at ditka.UUCP (Karl Swartz) writes:
>
>>The SYMPTOMS: /etc, /bin and /dev on this person's system are no longer
>>directories, they are files.  Yes, files.
>
>What do the contents of those files look like?  Do they look like
>what you'd expect to see if you 'cat /dev' (or od or whatever you
>like)?  If so it may simply be a matter of rewriting the inodes
>with the proper bits set in the file mode.  I don't know of any
>nice easy way to do it -- you'd have to write some code to do it
>on another machine, but it shouldn't be that hard.
>

A very easy way to do this is using ls -il and then fsdb.  You use
the ls -il command to find out the inode of the file in question.
Then run fsdb /dev/rfp002 (you have to be super user).  fsdb is
one of those friendly unix programs, so it's prompt is non-existent.
Issue the command xxxi, where xxx is the inode number.  This will
give you a little printout of the contents of that indoe, which
includes the permissions, size, owner, time stamps, and so on.

To set the permissions for a directory such as /etc, issue the
command md=040755.  To get out of fsdb type in the command q.
To check your handy work, type in the comand xxxi again, and
you should get a new look at the file, with the proper permissions
this time around.

Please understand that fsdb allows you byte by byte access to your
disk drive.  Once you change something, it's changed.  So be careful.

--

The only problem with what I've outlined above, is that you will
need to create a bootable floppy file system with fsdb on it.  I
say this, because fsdb is located in /etc, which is one of the
trashed directories.  This is easy to do if you have another 3b1...

Good luck.

John Canning					...uunet!uvm-gen!banzai!john
The People's Computer Company			...attmail!banzai!john
Williston, Vermont				john at banzai.pcc.com
802-864-0747