XFS, empty files after a crash

[Nathaniel W. Turner]

On 02/23/2012 03:07 PM, kadafax at gmail.com wrote:
>
>> kfx, try getting the inode number of the file (via stat or ls -i) and then 
>> doing something like this:
>>
>> xfs_db -r $DEV -c "inode $INO" -c "bmap" 
>
>
> # xfs_db -r /dev/sdc1 -c "inode 114748" -c "bmap"
> data offset 0 startblock 1881705728 (7/2657536) count 6460 flag 0
>
> # xfs_db -r /dev/sdc1 -c "inode 114754" -c "bmap"
> data offset 0 startblock 1077794560 (4/4052736) count 6582 flag 0

If you want to see what's behind those data extents (which are probably 
partially written), you could do something along these lines:

# Determine the AG size
agblocks=$(xfs_db -r /dev/sdc1 -c sb -c p | grep ^agblocks | sed 's/.* = //')

# Copy the extent in the first file, which consists of 6460 blocks (~26MB)
# in AG 7 starting at AG-relative block 2657536:
dd if=/dev/sdc1 bs=4096 skip=$(($agblocks * 7 + 2657536)) count=6460 of=./blob
# examine ./blob
...