Adam Milazzo wrote:
I will try that, but I'd like to note one thing. The drive actually had
everything deleted with [essentially] 'rm -rf /mnt/drive/*'.
Isn't there still a utility to print out the contents of the transaction log?
If the history in the log goes back far enough, then you will see images of
all of the inodes as they existed before they were deleted. XFS uses post-image
logging so you will not see the extent lists in the log transaction that deletes
the file, you will have to look for the change just prior to that.
The log will include the extent lists where your blocks were located as well as
where the directory entries for the filesystem were located. Looking backward
in the log is exactly like looking backward in time (to before the deletions).
Note that the log might not go back far enough, the on-disk structures are
rather complex, the log records are also complex, etc, etc...
Thanks,
Curtis
--
Curtis Anderson Storage Architect
curtisanderson1@xxxxxxxxx
|