LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices


Reply
  Search this Thread
Old 08-28-2004, 04:51 PM   #1
KingofBLASH
Member
 
Registered: Sep 2003
Distribution: Just upgraded to Slackware 10.0
Posts: 91

Rep: Reputation: 15
Question Creating a version of grep for swap


I recently lost quite a bit of data due to a power outage, and tried recovering it by grepping through my swap partition. I found bits and pieces, but every line of data I found would be preceded and followed by garbage. How does the swap partition store data, and how could I go about creating a program to reconstruct the bits and pieces of info in swap? And, more importantly, how much work would it be?
 
Old 08-28-2004, 06:45 PM   #2
jlliagre
Moderator
 
Registered: Feb 2004
Location: Outside Paris
Distribution: Solaris 11.4, Oracle Linux, Mint, Debian/WSL
Posts: 9,789

Rep: Reputation: 492Reputation: 492Reputation: 492Reputation: 492Reputation: 492
A swap partition contains essentially fixed size blocks of data (4KB) corresponding to portions of memory contents the system decided to place temporarily there because RAM was needed for another use.
Depending on your RAM size and your applications demand, your swap space may be never, moderately or heavily used, with the performance of your system degrading "exponentially".
The problem in what you are trying to achieve is that your are looking for "lines of data" on a partition containing pages that it is impossible to order or even connect to a specific process, because all this indexing was lost when to O/S stopped.

The truth too is that a lot of data was definitely lost anyway because it was only present in RAM. The data available in the swap area is randomly located and there is no way to know if the pages are valid, or just "ghosts" of previous versions of data obsoleted by an update.
Data present in the swap is also exactly laid out under the form the application itself used in memory, which is usually different from what you expect it to be (a file saved on disk), explaining probably most of the garbage surrounding what you already found.

Sorry to be so un-optimistic, but I think trying to build something from a swap is a waste of energy.

Not sure about how you "grep" in the swap, but probably the best command to use here is "strings", which is able to extract anything that looks like a string from garbage.

Last edited by jlliagre; 08-28-2004 at 06:46 PM.
 
Old 08-28-2004, 08:15 PM   #3
KingofBLASH
Member
 
Registered: Sep 2003
Distribution: Just upgraded to Slackware 10.0
Posts: 91

Original Poster
Rep: Reputation: 15
To grep through the swap I used dd to create an exact image of my swap partition, and then used grep to search for keywords I knew my data contained within the swap file. I found several lines from my data, but I guess it is lost. Strings still turns up lots of rubbish, and if there is no way to tell what data belongs with what, I would basically have to rewrite a swap filesystem, wouldn't I?
 
Old 08-28-2004, 09:25 PM   #4
infamous41md
Member
 
Registered: Mar 2003
Posts: 804

Rep: Reputation: 30
this might help: vim tries to recover data from swap, maybe you should check that out. i realize vim source is huge, but maybe you could google to get some idea how it does it, or post on a vim mailing list or something.
 
Old 08-28-2004, 09:37 PM   #5
aluser
Member
 
Registered: Mar 2004
Location: Massachusetts
Distribution: Debian
Posts: 557

Rep: Reputation: 43
vim creates little files called swap files while it's editing, e.g. .foo.txt.swp when you edit foo.txt. This is what it restores from. This is unrelated to your swap partition, unfortunately.
 
Old 08-28-2004, 10:14 PM   #6
jlliagre
Moderator
 
Registered: Feb 2004
Location: Outside Paris
Distribution: Solaris 11.4, Oracle Linux, Mint, Debian/WSL
Posts: 9,789

Rep: Reputation: 492Reputation: 492Reputation: 492Reputation: 492Reputation: 492
Quote:
I would basically have to rewrite a swap filesystem, wouldn't I?
The swap partition doesn't contains anything like a file-system, so it is pointless to write a "swap filesystem".
Swap only purpose is to allow more programs to run concurrently than the actual physical memory would support.
Nothing to help you restoring lost data, unless you are very lucky.

I suggested to use the command "strings", did you tried it ?

You do not tell us what kind of data and what program was used to manage it too.

--edit--
Sorry, you did try "strings", I missed it in your answer

Last edited by jlliagre; 08-29-2004 at 04:44 AM.
 
Old 08-28-2004, 10:22 PM   #7
aluser
Member
 
Registered: Mar 2004
Location: Massachusetts
Distribution: Debian
Posts: 557

Rep: Reputation: 43
To summarize,

The fundamental problems here are that:

The order and encoding of your data within swap space is dependent on the application you were using to edit it, as well as on the whims of the kernel

and

Your data may not have *ever* made it to swap in the first place, or only parts of your data may have made it to swap.

So, the data may not be recoverable at all, and, if it is, there's no generic way of doing it.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Creating a swap partition on an old pc, WITHOUT using linux... TheMusicGuy Linux - General 17 08-09-2004 12:43 AM
problem creating swap partition during installation kristof Red Hat 11 07-03-2004 01:25 PM
creating swap lynos Linux - General 6 03-27-2004 07:07 AM
Creating a swap partition thejackal13 Linux - Newbie 6 10-30-2003 07:03 PM
Creating a swap partition dsuniln Linux - Newbie 9 06-30-2003 12:18 PM

LinuxQuestions.org > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 01:52 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration