xfs
[Top] [All Lists]

RE: UPDATE: low-level XFS drive recovery

To: "'linux-xfs@xxxxxxxxxxx'" <linux-xfs@xxxxxxxxxxx>
Subject: RE: UPDATE: low-level XFS drive recovery
From: Adam Milazzo <adam@xxxxxxxxxxxx>
Date: Wed, 24 Apr 2002 12:37:31 -0700
Sender: owner-linux-xfs@xxxxxxxxxxx
I'm not sure, but what you described sounds useful. I might try to do some
research regarding that as well. Using 'xfs_repair -n' printed out some
helpful-looking information, and I've had some success recovering small
files by scanning the drive and trying to find valid file headers. However,
I don't know if large (100mb - 700mb) files are stored in contiguous blocks,
like the small files were. If they are, then I can continue recovering files
by programmatically searching for file headers. If not, then searching for
the headers is pointless, as the file won't be in a single chunk anyway. In
that case, I'd need to recover the directory information (if possible) to
help me piece everything back together. If that's not possible, then what
you described might be the only way to go about it.

However, I can't seem to find any detailed documentation regarding low-level
details like this! And trying to figure it out through hex editing and the
XFS source code is a bit tough. :)

Thanks for the suggestion!
Adam M.

-----Original Message-----
From: Curtis Anderson [mailto:curtisanderson1@xxxxxxxxx]
Sent: Wednesday, April 24, 2002 12:32 PM
To: Adam Milazzo
Cc: 'linux-xfs@xxxxxxxxxxx'
Subject: Re: UPDATE: low-level XFS drive recovery


Adam Milazzo wrote:

> I will try that, but I'd like to note one thing. The drive actually had
> everything deleted with [essentially] 'rm -rf /mnt/drive/*'.


Isn't there still a utility to print out the contents of the transaction
log?

If the history in the log goes back far enough, then you will see images of
all of the inodes as they existed before they were deleted.  XFS uses
post-image
logging so you will not see the extent lists in the log transaction that
deletes
the file, you will have to look for the change just prior to that.

The log will include the extent lists where your blocks were located as well
as
where the directory entries for the filesystem were located.  Looking
backward
in the log is exactly like looking backward in time (to before the
deletions).

Note that the log might not go back far enough, the on-disk structures are
rather complex, the log records are also complex, etc, etc...

Thanks,

        Curtis

-- 
Curtis Anderson         Storage Architect
curtisanderson1@xxxxxxxxx


<Prev in Thread] Current Thread [Next in Thread>