LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (http://www.linuxquestions.org/questions/linux-software-2/)
-   -   how do I undelete files on an XFS filesystem (http://www.linuxquestions.org/questions/linux-software-2/how-do-i-undelete-files-on-an-xfs-filesystem-718787/)

felbvts 04-13-2009 09:48 AM

how do I undelete files on an XFS filesystem
 
Hi All,
I need your help!
We need to recover data that an app deleted. The data sits (well, used to) on an XFS filesystem. We've heard some rumors that we can 'undelete' files on a linux server, but so far I have not been able to find a way to do it due to the xfs filesystem. Has anyone done this? Know a product we can buy to help us? Any feedback will be usefull. Thanks!

MQMan 04-13-2009 01:42 PM

You may be out of luck.

Cheers.

inside-man 04-13-2009 02:46 PM

Hopefully this is not thousands of files....

I have had never tested procedures to undelete files...
But with this tools you are able to recover files, it not depends on a filesytem.
http://www.cgsecurity.org/wiki/PhotoRec


It is easy to use, and makes a very good Job.

Good Luck, Randolf Balasus

MS3FGX 04-13-2009 02:53 PM

My understanding is that recovering files from an XFS partition is generally not feasible. I would be interested in hearing if anyone knew of a reliable way to do it though.

felbvts 04-20-2009 03:43 PM

Thanks for your help.

We tried quite a few things and yes, it does seem to be impossible.

Danws 04-27-2009 03:41 AM

Hi all,
It seems to be there are only one utility that supports 'undelete' from XFS: the Raise Data Recovery for XFS (http://www.ufsexplorer.com/rdr_xfs.php).

Not sure if it can help in your specific situation, but it costs nothing to try...

felbvts 04-29-2009 12:14 PM

Thanks! we tried it... it didn't work - our data was on remote disks.

Danws 04-30-2009 01:41 AM

Quote:

Originally Posted by felbvts (Post 3524933)
it didn't work - our data was on remote disks.

- To try any recovery, anyway you have to connect drives 'locally' for direct disk access.

If not a secret - was the data on some of these popular NAS boxes with XFS? Or some kind of real 'big server'?
Are there any chance to take drive(s) off and connect externally to Windows PC?

felbvts 05-04-2009 09:00 AM

Yes, the data was on a NAS - not sure which type. The server/data wasnt mine - I got involved because my co-worker, a windows admin, thought I, the linux admin, could help. I told him his data was likely gone. There were 2 companies that said we could send the disks in but we didn't feel the data was that important. Our management agreed.

I found that with XFS it is likely with various versions of software to recover corrupted data but deleted data is much more difficult.

And yes, just about all the software I found needs the disks to be locally mounted. That just wasn't feasible since we lost approx 2T of data. (FYI - the deletion was due to a software bug.)

georg74 09-24-2009 02:53 PM

I had a similar situation where the data was on remote RAID. The whole file system was deleted with rm -r /mnt/point/. I was able to recover the data including file names:
- unmounted the file system (/mnt/point)
- took a win32 box and created a big enough RAID0
- created a partition on it, type "Linux"
- installed "Raise Data Recovery for XFS" (demo mode)
- copied the source partition to the new, local one block-by-block (dd)
- (next morning) let RDR_XFS scan the partition
- (in the evening) checked found folders and file names, registered the software, let it copy data to ext. HDD
- (next morning) checked the restored files - almost everything was ok

I have to mention that
a) the original file system had no fragmentation
b) it was not used after deletion,
so RDR_XFS had an easy job with it.

Danws 10-25-2009 03:06 PM

Quote:

Originally Posted by georg74 (Post 3695975)
a) the original file system had no fragmentation

- this one of advantages of XFS; that's why in good hardware implementation it is the best choice for Linux-based storage.

Quote:

Originally Posted by georg74 (Post 3695975)
b) it was not used after deletion,
so RDR_XFS had an easy job with it.

- this is most critical! The less probability you write anything - the better chances for recovery.

The RDR XFS handles easy fragmented files as well so I think at present this is the best choice for XFS recovery.

Just for reference: Raise Data Recovery for XFS

robayer 02-17-2010 03:45 PM

Raise Data for XFS seems to be the ticket
 
Quote:

Originally Posted by georg74 (Post 3695975)
- copied the source partition to the new, local one block-by-block (dd)
- (next morning) let RDR_XFS scan the partition
- (in the evening) checked found folders and file names, registered the software, let it copy data to ext. HDD
- (next morning) checked the restored files - almost everything was ok

I am in a similiar situation now recovering a large amount of unfragemented data that was secured immediately when we knew we had to recover. Currently using the newest version of Raise Data for XFS.

Question: How much data did you recover and how long did it take?

Danws 03-22-2010 09:16 AM

Quote:

Originally Posted by robayer (Post 3867361)
I am in a similiar situation now recovering a large amount of unfragemented data that was secured immediately when we knew we had to recover. Currently using the newest version of Raise Data for XFS.

Question: How much data did you recover and how long did it take?

On practice it recovers about 95-100% of deleted files (for optimistic scenario with immediate shutdown/unmount after data loss). About 85-95% of recovered files are with real names and are at correct "recovered directory tree" position.

How much it takes? Hmmm... Depends much of drive connection. I tried USB but it was VERY SLOW (probably due to large number of random read). With native (SATA) connection if worked at about 80% of maximum HDD bandwidth (most likely will depend of HDD model).

One more observation: when software steps on large group of file descriptors it works slowly and use much CPU; when returns to file data - it resumes fast scan. So I think real scan speed depends much of number of files as well.

By the way, have you seens this: http://www.ufsexplorer.com/download.php - they released version for Linux! :)

milescortez 12-08-2010 01:37 PM

Maybe there is hope
 
Quote:

Originally Posted by Danws (Post 3907582)
On practice it recovers about 95-100% of deleted files (for optimistic scenario with immediate shutdown/unmount after data loss). About 85-95% of recovered files are with real names and are at correct "recovered directory tree" position.

How much it takes? Hmmm... Depends much of drive connection. I tried USB but it was VERY SLOW (probably due to large number of random read). With native (SATA) connection if worked at about 80% of maximum HDD bandwidth (most likely will depend of HDD model).

One more observation: when software steps on large group of file descriptors it works slowly and use much CPU; when returns to file data - it resumes fast scan. So I think real scan speed depends much of number of files as well.

By the way, have you seens this: - they released version for Linux! :)


OK---So I didn;t delete the files---I deleted the share. I am working on a 1TB lacie ethernet Big disk which consists of 2 500GB disks. I know all the data is there from running scans on the drive (imaged copy) with other windows software so that is good. The key for me is to the the file names back and hoepfully the directory/folder tree. Otherwise I'll have about 8 months of work renaming files.

Is the Raid Data Recovery for XFS in windows my best option? I assume I should recover off the image and not off the drive itself but are the results in RDRXFS any different/better if I go to the drive directly? Like I said---I just deleted the share--not the files. I know the files are there I just can;t see them. Any help would be greatly appreciated. I've been dealing with this for weeks!

Danws 12-09-2010 02:53 AM

Quote:

Originally Posted by milescortez (Post 4185017)
OK---So I didn;t delete the files---I deleted the share.

In most cases doesn't matter because of 'recursive' nature of delete operation (file system driver needs to release all the inodes and release disk space taken by the files under /share).


Quote:

Originally Posted by milescortez (Post 4185017)
I am working on a 1TB lacie ethernet Big disk which consists of 2 500GB disks. I know all the data is there from running scans on the drive (imaged copy) with other windows software so that is good. The key for me is to the the file names back and hoepfully the directory/folder tree. Otherwise I'll have about 8 months of work renaming files.

Yes, Linux drivers never pay much and never wipe actual user data from disks. It will be there before overwritten. Imaging the drives is good idea for several reasons:
- you will guarantee original data will be not modified;
- drive will not fail during recovery;
- in many cases externally attached drive works slower than image file on local file system.

Quote:

Originally Posted by milescortez (Post 4185017)
Is the Raid Data Recovery for XFS in windows my best option?

For deleted files recovery from XFS file system it is only known solution (especially with possibly large number of deleted files that will not fit to journal).

Quote:

Originally Posted by milescortez (Post 4185017)
I assume I should recover off the image and not off the drive itself but are the results in RDRXFS any different/better if I go to the drive directly?

It's recommended to continue with images - see above; the supplied data is the same so software will be at least not worse.

By the way, 1TB over 2 500GB drives means your NAS was configured either as RAID 0 or JBOD. In both cases RAID 'reconstruction' is required to supply valid block device image to RDR. To make this reconstruction you may either use their plugin; as alternative (in case you have much free disk space) you may make complete RAID0/JBOD image with other software (e.g. with trial copy of their Professional Recovery program).
I guess some information from SDL knowledge base (on ufsexplorer.com website) can be useful for this issue understanding.


All times are GMT -5. The time now is 07:07 AM.