SlackBuilds Repository

15.0 > System > xfs_undelete (15.0)

An undelete tool for the XFS filesystem.

What does it?
xfs_undelete tries to recover all files on an XFS filesystem marked
as deleted. You may also specify a date or age since deletion, and
file types to ignore or to recover exclusively.

xfs_undelete does some sanity checks on the files to be recovered.
This is done to avoid recovering bogus petabyte sized sparse files.
In addition, it does not recover anything unidentifiable (given you
have the file utility installed) by default. Specify -i "" on the
command line if you want to recover those unidentifiable files.

The recovered file is stored on another filesystem in a subdirectory,
by default xfs_undeleted relative to the current directory. The
filename cannot be recovered and thus, it is put as the time of
deletion, the inode number, and a guessed file extension. You have
to check the recovered files you are interested in by hand and rename
them properly.

How does it work?
xfs_undelete traverses the inode B+trees of each allocation group,
and checks the filesystem blocks holding inodes for the magic string
IN\0\0 that indicates a deleted inode. Then, it tries to make sense
of the extents stored in the inode (which XFS does not delete) and
collect the data blocks of the file.

Is it safe to use?
Given it only ever reads from the filesystem it operates on, yes.
It also remounts the filesystem read-only on startup by default so
you don’t accidentally overwrite source data. However, I don’t offer
any warranty or liability. Use at your own risk.

Maintained by: Bloyburt
Keywords: recovery,xfs,undelete,forensic
ChangeLog: xfs_undelete