de - A Minix Disk Editor Terrence W. Holm, Jan. 1989 INTRODUCTION The de(1) disk editor allows a system administrator to look at and modify a Minix file system device. Commands allow movement throughout a file system device, displaying information in a couple of formats, writing blocks from the device onto another file, and rewriting words on the disk. A few changes to the Minix file system aid recovering files. I-node numbers are retained in directory entries now (they get moved to the end). And all the i-node information is not zeroed-out when a file is unlinked. So, after a file is accidently rm(1)'ed, you can find the old i-node, and then manually (or automatically) go to each of the freed blocks and write them to a new file. USES FOR THE DISK EDITOR 1) EDUCATION. Students can look at a file system in a painless manner. For example you don't have to use od(1) to look at the zone numbers in i-nodes. A simple assignment is to change the size of an un-mounted floppy disk file system from 360 to 300 blocks. (A more difficult assignment is to explain why this works, even though fsck(1) and df(1) do not report the correct number of free blocks. :-) 2) ADMINISTRATION. You can visually check inconsistencies reported by fsck(1) before letting fsck(1) fix them. You can change any word on the disk, this greatly simplifies editing file system information. For example, changing the size of a block special device is actually fun, no more "blind" writing to your partitions. Bit maps can be displayed with 2048 "bits" per screen, (on the IBM/PC console), see how your zones are allocated! 3) RECOVERING LOST FILES. You can search a disk for an ASCII string, once found, the block can be written out to a file. A one line change to fs/path.c allows users to get the i-node number for a file after it has been removed from a directory. Another couple lines changed in the file system keep the i-node information available until the i-node is reused (normally this information is zeroed out when an i-node is released.) This allows a de(1) user to go to a released i-node, get all the block numbers, go to these blocks and write them back to a new file. The whole recovery process is automated by running "de -r file". So, IF a file is unlink(2)'ed (eg. "rm file"), AND IF no one allocates a new i-node or block in the mean-time, THEN you can recover the file. RECOVERY SECURITY Normally Minix hard disk partitions are r/w only by the super-user, and floppy disks are r/w by anyone. This means that only "root" can look at hard disk partitions, but others can use de(1) to play with their floppy disks. When recovering files ("de -r file"), a user requires access to the major file system partitions. This can be done by: (a) Give everyone access to the hard disks. DON'T DO THIS, it defeats all the file system protection we already have. (b) Make de(1) set-uid "root". This is the way to go, IF you are running a Minix system that has NO ACCESS from the outside. This allows anyone to execute "de -r file", but only root to use "de /dev/hd3". De(1) does some checking when retrieving lost blocks, eg. making sure they really are free blocks and making sure the user owned the i-node. BUT, file system information has been lost when the file was unlink(2)'ed, so de(1) can not be 100% sure that a recovered block really belonged to the user. THIS IS A SECURITY HOLE. [Since the only access to my machine is from observable terminals and their associated humans, I run de(1) as set-uid root.] (c) Keep the disks rw-------, and don't set-uid de(1). This means that only the super-user can recover lost files. So, if you accidently "rm", you must tell the system administrator to "su" and recover your file, (be sure to inform the other users to stop whatever they are doing until the file is restored). INSTALLATION - Install de.1 in /usr/man/cat1. - Install the files: Makefile, README, de.h, de.c, de_stdin.c, de_stdout.c, de_diskio.c and de_recover.c in commands/de. Add -F and -T. to the Makefile, if necessary. - "make" de(1). If a header file is not found, don't worry: You probably have it somewhere, just link it to what de(1) is looking for. This program also requires the subroutine tolower(3), see EFTH MINIX report #50, if you don't have it. - Do you really want set-uid root on de? - Patch the files fs/path.c, fs/link.c and fs/open.c. If you don't patch the file system then the recover option "-r" and associated commands ('x' and 'X') will not work, but de(1) is still functional and useful. - "make" a new fs, using -DRECOVER. Rebuild a boot diskette. USING DE(1) FOR THE FIRST TIME De(1) starts up in "word" mode at block 0 of the specified device. Hit the PGDN (or space bar) a few times, observing all the information on the screen. Each PGUP/PGDN moves to the next 1024 byte block, (de(1) only knows about 1 block per zone file systems). Note that "word" mode only displays 32 bytes at a time, so you are only observing the first 32 bytes in the first few blocks when you skip using PGDN. Now go back to block 3, (zone bit map), using "g 3 ENTER". Change to "map" mode "v m", and then use the down arrow key to check each 2 Megs in the zone bit map. Now change to "block" mode using "v b". And go to some data block, eg. "g 1000 ENTER". Use PGUP/PGDN to see what data is in each nearby block. Remember 'h' gives you a help page. Try some more commands, for example: 'END', 'I', '/'. (Note: searching through a whole disk under Minix takes a long time: 30-60 seconds per megabyte, depending on your machine, drive and controller, [Minix is embarrassingly slow].) Don't worry about looking at a mounted device, you must specify the "-w" option before the 's' command is operational, and this command is the only one which will try to modify the contents of the device. MINIX-ST Please contact me if you are interesting in attempting a port to MINIX-ST.