Hi All,
I need your help!
We need to recover data that an app deleted. The data sits (well, used to) on an XFS filesystem. We've heard some rumors that we can 'undelete' files on a linux server, but so far I have not been able to find a way to do it due to the xfs filesystem. Has anyone done this? Know a product we can buy to help us? Any feedback will be usefull. Thanks!

You may be out of luck.

Cheers.

Hopefully this is not thousands of files....

I have had never tested procedures to undelete files...
But with this tools you are able to recover files, it not depends on a filesytem.
http://www.cgsecurity.org/wiki/PhotoRec


It is easy to use, and makes a very good Job.

Good Luck, Randolf Balasus

My understanding is that recovering files from an XFS partition is generally not feasible. I would be interested in hearing if anyone knew of a reliable way to do it though.

Thanks for your help.

We tried quite a few things and yes, it does seem to be impossible.

Hi all,
It seems to be there are only one utility that supports 'undelete' from XFS: the Raise Data Recovery for XFS (http://www.ufsexplorer.com/rdr_xfs.php).

Not sure if it can help in your specific situation, but it costs nothing to try...

Thanks! we tried it... it didn't work - our data was on remote disks.

- To try any recovery, anyway you have to connect drives 'locally' for direct disk access.

If not a secret - was the data on some of these popular NAS boxes with XFS? Or some kind of real 'big server'?
Are there any chance to take drive(s) off and connect externally to Windows PC?

Yes, the data was on a NAS - not sure which type. The server/data wasnt mine - I got involved because my co-worker, a windows admin, thought I, the linux admin, could help. I told him his data was likely gone. There were 2 companies that said we could send the disks in but we didn't feel the data was that important. Our management agreed.

I found that with XFS it is likely with various versions of software to recover corrupted data but deleted data is much more difficult.

And yes, just about all the software I found needs the disks to be locally mounted. That just wasn't feasible since we lost approx 2T of data. (FYI - the deletion was due to a software bug.)

I had a similar situation where the data was on remote RAID. The whole file system was deleted with rm -r /mnt/point/. I was able to recover the data including file names:
- unmounted the file system (/mnt/point)
- took a win32 box and created a big enough RAID0
- created a partition on it, type "Linux"
- installed "Raise Data Recovery for XFS" (demo mode)
- copied the source partition to the new, local one block-by-block (dd)
- (next morning) let RDR_XFS scan the partition
- (in the evening) checked found folders and file names, registered the software, let it copy data to ext. HDD
- (next morning) checked the restored files - almost everything was ok

I have to mention that
a) the original file system had no fragmentation
b) it was not used after deletion,
so RDR_XFS had an easy job with it.

- this one of advantages of XFS; that's why in good hardware implementation it is the best choice for Linux-based storage.

- this is most critical! The less probability you write anything - the better chances for recovery.

The RDR XFS handles easy fragmented files as well so I think at present this is the best choice for XFS recovery.

Just for reference: Raise Data Recovery for XFS

I am in a similiar situation now recovering a large amount of unfragemented data that was secured immediately when we knew we had to recover. Currently using the newest version of Raise Data for XFS.

Question: How much data did you recover and how long did it take?

On practice it recovers about 95-100% of deleted files (for optimistic scenario with immediate shutdown/unmount after data loss). About 85-95% of recovered files are with real names and are at correct "recovered directory tree" position.

How much it takes? Hmmm... Depends much of drive connection. I tried USB but it was VERY SLOW (probably due to large number of random read). With native (SATA) connection if worked at about 80% of maximum HDD bandwidth (most likely will depend of HDD model).

One more observation: when software steps on large group of file descriptors it works slowly and use much CPU; when returns to file data - it resumes fast scan. So I think real scan speed depends much of number of files as well.

By the way, have you seens this: http://www.ufsexplorer.com/download.php - they released version for Linux!

OK---So I didn;t delete the files---I deleted the share. I am working on a 1TB lacie ethernet Big disk which consists of 2 500GB disks. I know all the data is there from running scans on the drive (imaged copy) with other windows software so that is good. The key for me is to the the file names back and hoepfully the directory/folder tree. Otherwise I'll have about 8 months of work renaming files.

Is the Raid Data Recovery for XFS in windows my best option? I assume I should recover off the image and not off the drive itself but are the results in RDRXFS any different/better if I go to the drive directly? Like I said---I just deleted the share--not the files. I know the files are there I just can;t see them. Any help would be greatly appreciated. I've been dealing with this for weeks!

In most cases doesn't matter because of 'recursive' nature of delete operation (file system driver needs to release all the inodes and release disk space taken by the files under /share).


Yes, Linux drivers never pay much and never wipe actual user data from disks. It will be there before overwritten. Imaging the drives is good idea for several reasons:
- you will guarantee original data will be not modified;
- drive will not fail during recovery;
- in many cases externally attached drive works slower than image file on local file system.

For deleted files recovery from XFS file system it is only known solution (especially with possibly large number of deleted files that will not fit to journal).

It's recommended to continue with images - see above; the supplied data is the same so software will be at least not worse.

By the way, 1TB over 2 500GB drives means your NAS was configured either as RAID 0 or JBOD. In both cases RAID 'reconstruction' is required to supply valid block device image to RDR. To make this reconstruction you may either use their plugin; as alternative (in case you have much free disk space) you may make complete RAID0/JBOD image with other software (e.g. with trial copy of their Professional Recovery program).
I guess some information from SDL knowledge base (on ufsexplorer.com website) can be useful for this issue understanding.