I have done theste steps:

1) "ls -id {dir}"
(where dir is directory where file resided)
Record INODE number for next step.

2) Unmount the filesystem.

3) "fsdb /{Mountpoint}" or "fsdb /dev/{LVname}"
(where Mountpoint is the filesystem mount point, and LVname is
the logical volume name of the filesystem)

4) "{INODE}i"
(where INODE is the inode number recorded in step 1)
This will display the inode information for the directory. The
field a0 contains the block number of the directory.
The following steps assume only field a0 is used. If a value
appears in a1, etc, it may be necessary to repeat steps #5 and
#6 for each block until the file to be recovered is found.

5) "a0b"
(moves to block pointed to by field "a0" of this inode)

6) "p128c"
(prints 128 bytes of directory in character format)
Look for missing filename. If not seen, repeat this step until
filename is found. Record address where filename begins. Also
record address where PRIOR filename begins. If filename does
not appear, return to step #5, and selecting a1b, a2b, etc.

Note that the address of the first field is shown to the far left.
Increment the address by one for each position to the right,
counting in octal.

7) "a0b"
(moves to block pointed to by field "a0" of this inode)
If the filename was found in block 1, use a1b instead, etc.

8) "p128e"
(prints first 128 bytes in decimal word format)
Find the address of the file to recover (as recorded in step 6)
in the far left column. If address is not shown, repeat until
found.

9) Record the address of the file which appeared immediately PRIOR to
the file you want to recover.

10) Find the ADDRESS of the record LENGTH field for the file in step
#9 assuming the following format:

{ADDRESS}: x x x x x x x x x x ...
| | | | |-------- filename ------|
inode # --+----+ | |
| +-- filename length
record LENGTH --+

Note that the inode number may begin at any position on the line.
Note also that each number represents two bytes, so the address
of the LENGTH field will be `{ADDRESS} + (#hops * 2) + 1'

11) Starting with the first word of the inode number, count in OCTAL
until you reach the inode number of the file to be restored,
assuming each word is 2 bytes.



BUT I have problem with:

"0{ADDRESS}B={BYTES}"
(where ADDRESS is the address of the record LENGTH field found
in step #10, and BYTES is the number of bytes [octal] counted
in step #11)



I tried almost everything.... like:

p128e

0x0004469000: 0 16424 12 1 11776 0
1 22528
0x0004469010: 12 2 11822 0 0 16425
24 12
0x0004469020: 26990 26996 29551 30840 11891 29036
0 0
0x0004469030: 0 16426 20 8 26990 26996
11887 29281
0x0004469040: 0 0 0 16427 44 10
26990 26996
0x0004469050: 25719 11887 29281 0 0 16512
24 14
0x0004469060: 26990 26996 16718 21057 18776 11887
29281 0
0x0004469070: 0 16513 20 11 28530 24944
30529 20050
0x0004469080: 16713 22528 0 16514 380 9
27755 16718
0x0004469090: 21087 16713 22528 0 0 0
0 0
0x00044690a0: 0 0 0 0 0 0
0 0
0x00044690b0: 0 0 0 0 0 0
0 0
0x00044690c0: 0 0 0 0 0 0
0 0
0x00044690d0: 0 0 0 0 0 0
0 0
0x00044690e0: 0 0 0 0 0 0
0 0
0x00044690f0: 0 0 0 0 0 0
0 0
446901dB=100
?
0446901dB=256
?
446901d =+
?
000446901d=256
?
0000446901d=256
?
0000446901B=0
0x0000000385.B: 0x00000000 (0)
0000446901B=256
truncation error
?
0000446901B=255
0x0000000385.B: 0x00000000 (0)
0000446901dB=0
?
000446901dB=0
?
00x000446901dB=255
bad directory offset
?
0000446901dB=255
?
000446901dB=255
?
0446901dB=255
?
446901e=255
?
0446901e=255
?
0x000446901db=0
alignment
?
0x000446901dB=0
alignment
?
000446901dB=0
?
0000446901dB=0
?
0446901dB=0
?
446901dB=0
?
446901dB=22
?




I know that I should modify 0x000446901 to value 255 - but how to do
it? It should be:


0x000446901dB=255
alignment
?
000446901dB=255
?



but as you see it doesn't work !!!