Filesystem 'metadata' backup?
Short version:
- Why is it not possible to back up the core filesystem, i.e. everything except the actual data, for NTFS, ext3, etc and do data 'undeletion' based on this backup later? Reason is that of course backing up the actual data costs a lot of storage space.
Longer version:
With modern RAID arrays, you are reasonably well guarded against hardware failures. What you are not guarded against:
- Blowout (if some power surge or other hardware failure destroys many drives at the same time you're out of luck.. but I take this calculated risk)
- Something malicious (virus? estranged wife?) intentionally going 'rm -rf /'
- Someone stupid (me) accidentally going 'rm -rf /'
These last 2 seem eminently recoverable, all/most of the actual data is still there, just the pointers to it have been removed, so what I've been wondering is allowing me to make a snapshot of "everything except the actual data". If I accidentally nuke something I'd like to keep, and I of course don't start writing new data to the disk, wouldnt "restoring the FAT backup" fix my problem? Ideally I'd like to have something that creates a virtual filesystem that allows me to try to recover stuff based on that historical FAT without possibly damaging data by actually overwriting it.
Is there something flawed in my logic? Of course I realize modern FSes dont actually use a FAT anymore, but as long as you don't have a fully data journalling system the theory is sound, right?
