accidentally deleted very large file (3.5TB) but still available through loop device

[Martin Steigerwald]

Am Donnerstag 26 März 2009 schrieb Chris Allen:
> Hi,

Hi Chris,

> In a nutshell, I did the following:
>
> 1. dd if=some_filesystem_dump of=some_file (where some_file resides on
> an XFS filesystem and is 3.5TB large)
>
> 2. losetup /dev/loop0 some_file
>
> 3. mount /dev/loop0 /recovered
>
> [.... i can now access my recovered filesystem through /recovered ...]
>
> 4. rm some_file (remotely via an nfs export) (oops!)
>
> So, I just removed my 3.5TB file even though it is attached to the loop
> device and mounted (XFS did this almost instantly).
>
>
> Now it *appears* that the filesystem as attached to /dev/loop0 and
> mounted on /recovered is still OK. I
> can cd around it and copy files off.
>
> So I have these questions:
>
>
> 1. Is there any way I can get back the 1 file that I accidentally
> deleted (nothing else has been written to that partition since)

dd if=/dev/loop0 of=somefile-restore

should work IMHO.

> 2. Am I safe in accessing my filesystem through /dev/loop0 and
> /recovered even though the underlying file has been zapped? If so
> I can quickly copy everything off onto another partition.

Yes. XFS as other linux filesystems perform the real delete - i.e. freeing 
the blocks the file occupies - only after the last user of it has closed 
it. Before just the directory entry of the file is removed.

> 3. Will this command: dd if=/dev/loop0 of=saved_file get my file back?

I think it will. Just try it.

Ciao,
-- 
Martin 'Helios' Steigerwald - http://www.Lichtvoll.de
GPG: 03B0 0D6C 0040 0710 4AFA  B82F 991B EAAC A599 84C7