The recoveries on UFS file systems that we have recently been seeing were generally for large, multi gigabyte, files. UFS uses direct and indirect data allocation information, direct being pointing to file data and indirect pointing to allocation information that then points to file data. File deletion will destroy the direct allocation information when the inode is destroyed however the indirect allocation remains. The heads of the files were found manually. We were able to use file system information to refine our search rather than just trawling the entire data space. We then mapped out the used, valid, file system data and located what appeared to be the blocks of indirect allocation information for files. Following the indirection blocks we were able to rebuild the tail sections of the files and then rejoin the head and tail sections together. Please note this is a simplification of the actual analysis and work that took place.

I must stress that it is still not practicable to undertake a general un-deletion of files under UFS, this technique is for the recovery of selected file from within the UFS file system, and is dependent upon there not having been any writing back of data to the areas of disk used to store the required file, and some knowledge of the structure of the file that is required is still essential.