This week is the final offering of our topic Recovering a single file from a SNAP Server Operating System. We have learned what a Super Block is, a cylinder group, and some of the important data elements in those data structures. We have learned how to find these data structures by using the data elements of other structures. Finally, we have learned that the file system is broken into blocks and that these blocks are the storage cornerstone of SNAP OS. Putting all of these facts together we come down to the final data structure the inode. At the bottom of this article there are links to my other posts so you can read or print them all in order.

Recovering a single file from a SNAP OS Part 3

The inode is the final link in the chain of data storage.  It holds the map of the blocks where all of the data of each file and directory is stored. Let us dissect the inode and find its most important elements.

The SNAP OS Inode

Figure 1 is a raw hex representation of an inode. There are several data elements within the inode that define the date the file or directory was created, the last time it was updated, and the size of the file. For our purposes however, we are only concerned with one area of data elements and those are the direct and indirect block definitions. 

Fig 1

The direct block definitions are defined in the shaded green area, and there are a maximum of twelve direct data blocks. The term direct means that each one of the four byte numbers in the shaded green area point to an actual data storage block. In other words, if we take the first value of 0x14A80E (1353742 decimal) and go view that data block, we will find the first values for our file 2003STEP.PDF. In figure 2 we can see the first few bytes of data from block 0x14A80E.

Fig 2

There are only twelve direct data blocks so if your file exceeds 96 k, then the file system will use a method defined as indirect blocks. There are three data elements of these blocks, they are:

• Indirect Block: Points to a block that has a list of data blocks.
• Double Indirect Block: List of blocks that point to an Indirect block.
• Triple Indirect Block: List of blocks the point to Double Indirect blocks.

From the above explanation you can see how deciphering a very large file can be extremely complicated. Once understood, this method works well and is very fast. Along with those facts, it is also very easy to program using recursion and a set of flags to let the recursive function know what is being processed. 

Figure three is a listing of the 2003STEP.PDF direct blocks from its only indirect block.

Fig 3

Well, that’s it!  By using the formulas and techniques I have outlined in my last three articles you can easily retrieve any file. I hope this helps those of you that have lost data due to hardware and or software failures on your SNAP Server.

If you have any questions, or if I can be of any help, please feel free to call me, or drop me an email.

(727)345-9665 Ext 203

dickc AT dtidatarecovery.com

SNAP Server Data Recovery of a Single File

Here are all the articles about SNAP Server Recovery of a single file:

1. SNAP Data Recovery – the first post about the SNAP OS.
2. SNAP Server Data Recovery of a Single File – A detailed post about recovering a lost file on the SNAP OS.
3. SNAP Server Data Recovery Using The Super Block – the next article about SNAP file recovery.

Our main page for SNAP Server Data Recovery.