accidentally deleted very large file (3.5TB) but still available through loop device
Martin at lichtvoll.de
Thu Mar 26 11:36:52 CDT 2009
Am Donnerstag 26 März 2009 schrieb Chris Allen:
> In a nutshell, I did the following:
> 1. dd if=some_filesystem_dump of=some_file (where some_file resides on
> an XFS filesystem and is 3.5TB large)
> 2. losetup /dev/loop0 some_file
> 3. mount /dev/loop0 /recovered
> [.... i can now access my recovered filesystem through /recovered ...]
> 4. rm some_file (remotely via an nfs export) (oops!)
> So, I just removed my 3.5TB file even though it is attached to the loop
> device and mounted (XFS did this almost instantly).
> Now it *appears* that the filesystem as attached to /dev/loop0 and
> mounted on /recovered is still OK. I
> can cd around it and copy files off.
> So I have these questions:
> 1. Is there any way I can get back the 1 file that I accidentally
> deleted (nothing else has been written to that partition since)
dd if=/dev/loop0 of=somefile-restore
should work IMHO.
> 2. Am I safe in accessing my filesystem through /dev/loop0 and
> /recovered even though the underlying file has been zapped? If so
> I can quickly copy everything off onto another partition.
Yes. XFS as other linux filesystems perform the real delete - i.e. freeing
the blocks the file occupies - only after the last user of it has closed
it. Before just the directory entry of the file is removed.
> 3. Will this command: dd if=/dev/loop0 of=saved_file get my file back?
I think it will. Just try it.
Martin 'Helios' Steigerwald - http://www.Lichtvoll.de
GPG: 03B0 0D6C 0040 0710 4AFA B82F 991B EAAC A599 84C7
More information about the xfs