Zapped /etc,/bin,/dev ... how to recover user files?

[Karl Swartz]

In article <28295 at cup.portal.com> thad at cup.portal.com (Thad P Floryan) writes:
>The BACKGROUND: the person HAS a service contract with AT&T for which
>$66/month is paid.  The HotLine has also been contacted ...

Based on my experience with the people at the front door I wouldn't
have a service contract with them if they *paid me* %66/month.  (Of
course the folks around back working on the fix disks are good ...)

>The SYMPTOMS: /etc, /bin and /dev on this person's system are no longer
>directories, they are files.  Yes, files.

What do the contents of those files look like?  Do they look like
what you'd expect to see if you 'cat /dev' (or od or whatever you
like)?  If so it may simply be a matter of rewriting the inodes
with the proper bits set in the file mode.  I don't know of any
nice easy way to do it -- you'd have to write some code to do it
on another machine, but it shouldn't be that hard.

Alternately, a sequence like this might get you closer:

    mv /dev /dev.bad
    mkdir /dev
    cat </dev.bad >dev

Creating new files on that disk may not be a terribly bright idea
though so I'd certainly try the first route if I could.

Have you tried running fsck on the disk?  What happens?  Yes, I
know you can't get to /etc and the stock floppy boot filesystem
doesn't have fsck, but that's easy to deal with.

>From that person's description of the state of the system, my
>GUESS is that somehow the superblock became clobbered; what else
>could so alter the state of a directory?

I don't see how the superblock has anything to do with it -- the
filemode for a file is stored in the inode.

-- 
Karl Swartz			 |UUCP	uunet!apple!zygot!ditka!kls
1-408/223-1308			 |INet	zygot!ditka!kls at apple.com
"I never let my schooling get in |BIX	kswartz
the way of my education."(Twain) |Snail	1738 Deer Creek Ct., San Jose CA 95148