10

Is it possible to recover files that have been rm'ed from an XFS filesystem? How can I recover any files assuming they haven't been overwritten?

Edit: The existing questions regarding this topic are all assuming an ext{2,3,4} file system. I am looking for an XFS solution.

3
  • 2
    Possible duplicate of Unix/Linux undelete/recover deleted files
    – sebasth
    Commented Nov 30, 2017 at 17:01
  • 3
    Those provided answers are only for ext{2,3,4} file systems. That is why I have specified XFS filesystem. Commented Nov 30, 2017 at 20:19
  • Restore from a backup
    – llua
    Commented Jul 9, 2018 at 3:15

3 Answers 3

15

I deleted a python file that I knew had a specific fairly unique string in it. So I did the following:

$ sudo strings -td /dev/mapper/vg01-lv_opt | grep "class Team("
8648365228 class Team(object):
26133651864 class Team(Account):
26134147482 class Team(Account):

I now had the offsets in the lvol where that string was. I then did a dd around that area to recover the text:

sudo dd if=/dev/mapper/vg01-lv_opt of=/tmp/recover skip=26134140000 count=1M bs=1

...then I brought that smaller file into vi and trimmed around the file, and voila! I had my content back.

1
  • 1
    This worked perfectly for me! After hours of searching this worked the first time, thank you friend!!!!!
    – Amon
    Commented Apr 20, 2022 at 9:17
11

Because the methods from the XFS FAQ page did not work for me, I wrote a tiny recovery tool myself.

xfs_undelete

It recovered the 60 video files I accidentally mv'ed on top of each other instead of a subdir. Please comment on the tool at the github bug tracker.

2

After a bit of investigation, it looks like there is no official method but several methods are listed on the official XFS FAQ page

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .