DevHeads.net

can XFS filesystem recover rm'ed files?

Yes, I rm'ed the wrong directory. The disk has not been written to since,
now mounted ro. Is it possible to recover the files without doing forensics
on the whole partition? I know the UID and path. XFS is supposed to be
pretty amazing, can I get it to do this?

Thanks,
Dave

Comments

Re: can XFS filesystem recover rm'ed files?

By Gordon Messmer at 01/07/2019 - 17:03

On 1/7/19 1:28 PM, Dave Burns wrote:

I can't find any reports of successful undelete from XFS.

<a href="http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete_capability.3F" title="http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete_capability.3F">http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete...</a>

Red Hat suggests xfs_irecover, testdisk, and sleuthkit.  Others
recommend photorec.  I don't see XFS undelete support listed on the web
pages for either testdisk or photorec.

Good luck.