How to recover xfs data after rm?

Question

Is it possible to recover files that have been rm'ed from an XFS filesystem? How can I recover any files assuming they haven't been overwritten?

Edit: The existing questions regarding this topic are all assuming an ext{2,3,4} file system. I am looking for an XFS solution.

Possible duplicate of Unix/Linux undelete/recover deleted files — sebasth, Nov 30 '17 at 17:01
Those provided answers are only for ext{2,3,4} file systems. That is why I have specified XFS filesystem. — Timothy Pulliam, Nov 30 '17 at 20:19

score 14 · Accepted Answer · answered Dec 16 '19 at 05:17

I deleted a python file that I knew had a specific fairly unique string in it. So I did the following:

$ sudo strings -td /dev/mapper/vg01-lv_opt | grep "class Team("
8648365228 class Team(object):
26133651864 class Team(Account):
26134147482 class Team(Account):

I now had the offsets in the lvol where that string was. I then did a dd around that area to recover the text:

sudo dd if=/dev/mapper/vg01-lv_opt of=/tmp/recover skip=26134140000 count=1M bs=1

...then I brought that smaller file into vi and trimmed around the file, and voila! I had my content back.

This worked perfectly for me! After hours of searching this worked the first time, thank you friend!!!!! — Amon, Apr 20 '22 at 09:17

Janka · Answer 2 · 2020-02-08T23:55:17.377

11

Because the methods from the XFS FAQ page did not work for me, I wrote a tiny recovery tool myself.

xfs_undelete

It recovered the 60 video files I accidentally mv'ed on top of each other instead of a subdir. Please comment on the tool at the github bug tracker.

edited Feb 08 '20 at 23:55

answered Jul 08 '19 at 14:24

Janka

486

score 2 · Answer 3 · answered Nov 30 '17 at 21:55

2

After a bit of investigation, it looks like there is no official method but several methods are listed on the official XFS FAQ page

answered Nov 30 '17 at 21:55

Timothy Pulliam

3,723

How to recover xfs data after rm?

3 Answers3