LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 04-13-2009, 09:48 AM   #1
felbvts
Member
 
Registered: Mar 2009
Posts: 37

Rep: Reputation: 3
Question how do I undelete files on an XFS filesystem


Hi All,
I need your help!
We need to recover data that an app deleted. The data sits (well, used to) on an XFS filesystem. We've heard some rumors that we can 'undelete' files on a linux server, but so far I have not been able to find a way to do it due to the xfs filesystem. Has anyone done this? Know a product we can buy to help us? Any feedback will be usefull. Thanks!
 
Old 04-13-2009, 01:42 PM   #2
MQMan
Member
 
Registered: Jan 2004
Location: Los Angeles
Distribution: Slack64 13.37
Posts: 535

Rep: Reputation: 36
You may be out of luck.

Cheers.
 
Old 04-13-2009, 02:46 PM   #3
inside-man
LQ Newbie
 
Registered: Mar 2009
Posts: 16

Rep: Reputation: 1
Hopefully this is not thousands of files....

I have had never tested procedures to undelete files...
But with this tools you are able to recover files, it not depends on a filesytem.
http://www.cgsecurity.org/wiki/PhotoRec


It is easy to use, and makes a very good Job.

Good Luck, Randolf Balasus
 
Old 04-13-2009, 02:53 PM   #4
MS3FGX
Guru
 
Registered: Jan 2004
Location: NJ, USA
Distribution: Slackware, Debian
Posts: 5,852

Rep: Reputation: 351Reputation: 351Reputation: 351Reputation: 351
My understanding is that recovering files from an XFS partition is generally not feasible. I would be interested in hearing if anyone knew of a reliable way to do it though.
 
Old 04-20-2009, 03:43 PM   #5
felbvts
Member
 
Registered: Mar 2009
Posts: 37

Original Poster
Rep: Reputation: 3
Thanks for your help.

We tried quite a few things and yes, it does seem to be impossible.
 
Old 04-27-2009, 03:41 AM   #6
Danws
LQ Newbie
 
Registered: Jun 2006
Location: UK
Distribution: Ubuntu, Mac OS X, Windows 7
Posts: 12

Rep: Reputation: 0
Lightbulb

Hi all,
It seems to be there are only one utility that supports 'undelete' from XFS: the Raise Data Recovery for XFS (http://www.ufsexplorer.com/rdr_xfs.php).

Not sure if it can help in your specific situation, but it costs nothing to try...
 
Old 04-29-2009, 12:14 PM   #7
felbvts
Member
 
Registered: Mar 2009
Posts: 37

Original Poster
Rep: Reputation: 3
Thanks! we tried it... it didn't work - our data was on remote disks.
 
Old 04-30-2009, 01:41 AM   #8
Danws
LQ Newbie
 
Registered: Jun 2006
Location: UK
Distribution: Ubuntu, Mac OS X, Windows 7
Posts: 12

Rep: Reputation: 0
Quote:
Originally Posted by felbvts View Post
it didn't work - our data was on remote disks.
- To try any recovery, anyway you have to connect drives 'locally' for direct disk access.

If not a secret - was the data on some of these popular NAS boxes with XFS? Or some kind of real 'big server'?
Are there any chance to take drive(s) off and connect externally to Windows PC?
 
Old 05-04-2009, 09:00 AM   #9
felbvts
Member
 
Registered: Mar 2009
Posts: 37

Original Poster
Rep: Reputation: 3
Yes, the data was on a NAS - not sure which type. The server/data wasnt mine - I got involved because my co-worker, a windows admin, thought I, the linux admin, could help. I told him his data was likely gone. There were 2 companies that said we could send the disks in but we didn't feel the data was that important. Our management agreed.

I found that with XFS it is likely with various versions of software to recover corrupted data but deleted data is much more difficult.

And yes, just about all the software I found needs the disks to be locally mounted. That just wasn't feasible since we lost approx 2T of data. (FYI - the deletion was due to a software bug.)
 
Old 09-24-2009, 02:53 PM   #10
georg74
LQ Newbie
 
Registered: Mar 2007
Location: Austria
Distribution: Debian
Posts: 3

Rep: Reputation: 0
I had a similar situation where the data was on remote RAID. The whole file system was deleted with rm -r /mnt/point/. I was able to recover the data including file names:
- unmounted the file system (/mnt/point)
- took a win32 box and created a big enough RAID0
- created a partition on it, type "Linux"
- installed "Raise Data Recovery for XFS" (demo mode)
- copied the source partition to the new, local one block-by-block (dd)
- (next morning) let RDR_XFS scan the partition
- (in the evening) checked found folders and file names, registered the software, let it copy data to ext. HDD
- (next morning) checked the restored files - almost everything was ok

I have to mention that
a) the original file system had no fragmentation
b) it was not used after deletion,
so RDR_XFS had an easy job with it.
 
Old 10-25-2009, 03:06 PM   #11
Danws
LQ Newbie
 
Registered: Jun 2006
Location: UK
Distribution: Ubuntu, Mac OS X, Windows 7
Posts: 12

Rep: Reputation: 0
Quote:
Originally Posted by georg74 View Post
a) the original file system had no fragmentation
- this one of advantages of XFS; that's why in good hardware implementation it is the best choice for Linux-based storage.

Quote:
Originally Posted by georg74 View Post
b) it was not used after deletion,
so RDR_XFS had an easy job with it.
- this is most critical! The less probability you write anything - the better chances for recovery.

The RDR XFS handles easy fragmented files as well so I think at present this is the best choice for XFS recovery.

Just for reference: Raise Data Recovery for XFS

Last edited by Danws; 10-25-2009 at 03:07 PM.
 
Old 02-17-2010, 03:45 PM   #12
robayer
LQ Newbie
 
Registered: Feb 2010
Posts: 1

Rep: Reputation: 0
Raise Data for XFS seems to be the ticket

Quote:
Originally Posted by georg74 View Post
- copied the source partition to the new, local one block-by-block (dd)
- (next morning) let RDR_XFS scan the partition
- (in the evening) checked found folders and file names, registered the software, let it copy data to ext. HDD
- (next morning) checked the restored files - almost everything was ok
I am in a similiar situation now recovering a large amount of unfragemented data that was secured immediately when we knew we had to recover. Currently using the newest version of Raise Data for XFS.

Question: How much data did you recover and how long did it take?

Last edited by robayer; 02-17-2010 at 03:46 PM.
 
Old 03-22-2010, 09:16 AM   #13
Danws
LQ Newbie
 
Registered: Jun 2006
Location: UK
Distribution: Ubuntu, Mac OS X, Windows 7
Posts: 12

Rep: Reputation: 0
Quote:
Originally Posted by robayer View Post
I am in a similiar situation now recovering a large amount of unfragemented data that was secured immediately when we knew we had to recover. Currently using the newest version of Raise Data for XFS.

Question: How much data did you recover and how long did it take?
On practice it recovers about 95-100% of deleted files (for optimistic scenario with immediate shutdown/unmount after data loss). About 85-95% of recovered files are with real names and are at correct "recovered directory tree" position.

How much it takes? Hmmm... Depends much of drive connection. I tried USB but it was VERY SLOW (probably due to large number of random read). With native (SATA) connection if worked at about 80% of maximum HDD bandwidth (most likely will depend of HDD model).

One more observation: when software steps on large group of file descriptors it works slowly and use much CPU; when returns to file data - it resumes fast scan. So I think real scan speed depends much of number of files as well.

By the way, have you seens this: http://www.ufsexplorer.com/download.php - they released version for Linux!
 
Old 12-08-2010, 01:37 PM   #14
milescortez
LQ Newbie
 
Registered: Dec 2010
Posts: 1

Rep: Reputation: 0
Maybe there is hope

Quote:
Originally Posted by Danws View Post
On practice it recovers about 95-100% of deleted files (for optimistic scenario with immediate shutdown/unmount after data loss). About 85-95% of recovered files are with real names and are at correct "recovered directory tree" position.

How much it takes? Hmmm... Depends much of drive connection. I tried USB but it was VERY SLOW (probably due to large number of random read). With native (SATA) connection if worked at about 80% of maximum HDD bandwidth (most likely will depend of HDD model).

One more observation: when software steps on large group of file descriptors it works slowly and use much CPU; when returns to file data - it resumes fast scan. So I think real scan speed depends much of number of files as well.

By the way, have you seens this: - they released version for Linux!

OK---So I didn;t delete the files---I deleted the share. I am working on a 1TB lacie ethernet Big disk which consists of 2 500GB disks. I know all the data is there from running scans on the drive (imaged copy) with other windows software so that is good. The key for me is to the the file names back and hoepfully the directory/folder tree. Otherwise I'll have about 8 months of work renaming files.

Is the Raid Data Recovery for XFS in windows my best option? I assume I should recover off the image and not off the drive itself but are the results in RDRXFS any different/better if I go to the drive directly? Like I said---I just deleted the share--not the files. I know the files are there I just can;t see them. Any help would be greatly appreciated. I've been dealing with this for weeks!
 
Old 12-09-2010, 02:53 AM   #15
Danws
LQ Newbie
 
Registered: Jun 2006
Location: UK
Distribution: Ubuntu, Mac OS X, Windows 7
Posts: 12

Rep: Reputation: 0
Quote:
Originally Posted by milescortez View Post
OK---So I didn;t delete the files---I deleted the share.
In most cases doesn't matter because of 'recursive' nature of delete operation (file system driver needs to release all the inodes and release disk space taken by the files under /share).


Quote:
Originally Posted by milescortez View Post
I am working on a 1TB lacie ethernet Big disk which consists of 2 500GB disks. I know all the data is there from running scans on the drive (imaged copy) with other windows software so that is good. The key for me is to the the file names back and hoepfully the directory/folder tree. Otherwise I'll have about 8 months of work renaming files.
Yes, Linux drivers never pay much and never wipe actual user data from disks. It will be there before overwritten. Imaging the drives is good idea for several reasons:
- you will guarantee original data will be not modified;
- drive will not fail during recovery;
- in many cases externally attached drive works slower than image file on local file system.

Quote:
Originally Posted by milescortez View Post
Is the Raid Data Recovery for XFS in windows my best option?
For deleted files recovery from XFS file system it is only known solution (especially with possibly large number of deleted files that will not fit to journal).

Quote:
Originally Posted by milescortez View Post
I assume I should recover off the image and not off the drive itself but are the results in RDRXFS any different/better if I go to the drive directly?
It's recommended to continue with images - see above; the supplied data is the same so software will be at least not worse.

By the way, 1TB over 2 500GB drives means your NAS was configured either as RAID 0 or JBOD. In both cases RAID 'reconstruction' is required to supply valid block device image to RDR. To make this reconstruction you may either use their plugin; as alternative (in case you have much free disk space) you may make complete RAID0/JBOD image with other software (e.g. with trial copy of their Professional Recovery program).
I guess some information from SDL knowledge base (on ufsexplorer.com website) can be useful for this issue understanding.

Last edited by Danws; 12-09-2010 at 03:10 AM.
 
  


Reply

Tags
linux, undelete, xfs


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Undelete XFS file in SGI khoryh Linux - General 4 10-25-2009 03:09 PM
Increase size for XFS filesystem Bonsai_XYZ Linux - Software 2 07-22-2006 11:49 AM
What is the best filesystem? (mainly xfs vs ext3) calimer Linux - Software 16 03-02-2005 12:07 AM
XFS Filesystem on RH 9.0 Necessary? GATTACA Red Hat 7 12-29-2003 04:42 AM
XFS 64-bit filesystem sneeze Linux - Newbie 3 07-14-2003 05:15 AM


All times are GMT -5. The time now is 03:28 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration