Save my deleted files from a Stora NAS XFS drive!

January 14, 2014 1:46 PM

Hello! I stupidly "deleted" some files from my Netgear Stora NAS drive, in XFS format. I can mount the hard drive, but what's the best (and/or cheapest!) undelete software for dealing with XFS-formatted drives?

Results from UFSExplorer seem inconsistent, and it would cost me £100 to experiment with that anyway...

posted by almostwitty to Computers & Internet (2 answers total)

http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete_capability.3F

Q: Does the filesystem have an undelete capability?

There is no undelete in XFS.

However, if an inode is unlinked but neither it nor its associated data blocks get immediately re-used and overwritten, there is some small chance to recover the file from the disk.

photorec, xfs_irecover or xfsr are some tools which attempt to do this, with varying success.

There are also commercial data recovery services and closed source software like Raise Data Recovery for XFS which claims to recover data, although this has not been tested by the XFS developers.

As always, the best advice is to keep good backups.

Can you mount the drive read only from a Linux box & use one of those tools?
posted by pharm at 2:29 PM on January 14, 2014

First: Do NOT mount or fsck the file system! To be safe, make an image of the partition with dd, and work on that.

This is going to suck if:
* It's an SSD and the file system is using TRIM.
* You have written a bunch of stuff to the file system after you deleted those files
* The deleted files were fragmented, f.ex. if big and written to an almost full file system

You'll want to google terms like data forensics. Your problem isn't specific to XFS, or even hard disks. It's the problem of trawling through trillions of bytes to find the ones at the start and end of your file.

I think i've used magicrescue once.
posted by avian carrier at 6:01 PM on January 14, 2014 [1 favorite]