33 lines
1.5 KiB
Plaintext
33 lines
1.5 KiB
Plaintext
An undelete tool for the XFS filesystem.
|
||
|
||
What does it?
|
||
xfs_undelete tries to recover all files on an XFS filesystem marked
|
||
as deleted. You may also specify a date or age since deletion, and
|
||
file types to ignore or to recover exclusively.
|
||
|
||
xfs_undelete does some sanity checks on the files to be recovered.
|
||
This is done to avoid recovering bogus petabyte sized sparse files.
|
||
In addition, it does not recover anything unidentifiable (given you
|
||
have the file utility installed) by default. Specify -i "" on the
|
||
command line if you want to recover those unidentifiable files.
|
||
|
||
The recovered file is stored on another filesystem in a subdirectory,
|
||
by default xfs_undeleted relative to the current directory. The
|
||
filename cannot be recovered and thus, it is put as the time of
|
||
deletion, the inode number, and a guessed file extension. You have
|
||
to check the recovered files you are interested in by hand and rename
|
||
them properly.
|
||
|
||
How does it work?
|
||
xfs_undelete traverses the inode B+trees of each allocation group,
|
||
and checks the filesystem blocks holding inodes for the magic string
|
||
IN\0\0 that indicates a deleted inode. Then, it tries to make sense
|
||
of the extents stored in the inode (which XFS does not delete) and
|
||
collect the data blocks of the file.
|
||
|
||
Is it safe to use?
|
||
Given it only ever reads from the filesystem it operates on, yes.
|
||
It also remounts the filesystem read-only on startup by default so
|
||
you don’t accidentally overwrite source data. However, I don’t offer
|
||
any warranty or liability. Use at your own risk.
|