xfs_undelete(8)

📦
version 15.0 · 2 versions
, in opensuse-leap 16.0

🌸 xfs_undelete 💅

okay so bestie, this is xfs_undelete — section 8 of the System Manager's Manual, the undelete tool for the XFS filesystem. she's a little dramatic, she's a little dangerous, and she will absolutely get your deleted files back if you treat her right 🫶

✨ SYNOPSIS ✨

xfs_undelete [ -t timerange ] [ -T timerange ] [ -r filetypes ] [ -i
filetypes ] [ -x inodes ] [ -S size ] [ -z filetypes ] [ -o
output_directory ] [ -s start_inode ] [ -m magicfiles ] [ --no-remount-
readonly ] device
xfs_undelete -l [ -m magicfiles ]

💖 DESCRIPTION 💖

so xfs_undelete literally tries to recover all the files on an XFS filesystem that are marked as deleted. cute right? the filesystem gets specified with the device argument, and that should be the device name of the disk partition or volume that contains the filesystem. no cap.

you can also narrow it down by a date or age since deletion, and by file types you wanna ignore or recover exclusively. she's flexible like that ✨

now the important part, bestie: the recovered file cannot be undeleted in place, so it gets stored on another filesystem, in a subdirectory — by default xfs_undeleted, relative to the current directory. also the filename cannot be recovered, so it's put as the time of deletion, the inode number, and a guessed file extension. you have to check the recovered files you're actually interested in by hand and rename them properly 😭 and the file length cannot be recovered either, so the recovered files are padded with \0 characters up to the next xfs block size boundary. most programs simply ignore those \0 characters, but you may want to remove them by hand or automatically with the help of the -z option.

this tool does some sanity checks on the files to be recovered — that's to avoid "recovering" bogus petabyte sized sparse files 💀 and on top of that it does not recover anything unidentifiable (given you have the file utility installed) by default. specify -i "" on the command line if you want to recover those non-bogus but still unidentifiable files. iykyk 🧚

🎀 OPTIONS 🎀

  • -t timerange — only recover files that have been deleted within the given time range. the timerange value has to be put either as two timespecs separated by a doubledot e.g. 2020-03-19..-2hours, as a doubledot followed by a timespec as e.g. ..-2hours (which means a range starting at epoch), as a timespec followed by a doubledot as e.g. -2hours.. (which means a range ending now), or as a single timespec value. the latter means the same as a timespec followed by a double dot. timespecs may be all values Tcl's [clock scan] function accepts. see clock(n). by default, files deleted from epoch to now are being recovered ⭐
  • -T timerange — only recover files that have been modified within the given time range before they have been deleted. this option is useful if you know the date of your latest backup 👑 the timerange value has to be put either as two timespecs separated by a doubledot e.g. 2020-03-19..-2hours, as a doubledot followed by a timespec as e.g. ..-2hours (which means a range starting at epoch), as a timespec followed by a doubledot as e.g. -2hours.. (which means a range ending now), or as a single timespec value. the latter means the same as a timespec followed by a double dot. timespecs may be all values Tcl's [clock scan] function accepts. see clock(n). by default, files modified from epoch to now are being recovered ⭐
  • -r filetypes — only recover files with a filetype matching a pattern from this comma-separated list of patterns. see section FILETYPES below. by default this pattern is * ; all files are being recovered, but also see the -i option 👀
  • -i filetypes — ignore files with a filetype matching a pattern from this comma-separated list of patterns. see section FILETYPES below. by default this list is set to bin ; all files of unknown type are being ignored, but also see the -r option 👀
  • -x inodes — ignore files with an inode number from this comma-separated list. by default this list is empty.
  • -S size — ignore files with a size larger than specified. the number may be given as bytes or with an appended k, M, G as kilobytes, megabytes, gigabytes respectively. by default there is no size limit 🦋
  • -z filetypes — remove trailing zeroes from files with a filetype matching a pattern from this comma-separated list of patterns. see section FILETYPES below. by default this list is set to text/* ; all files of text/* mimetype have their trailing zeroes removed 🌸
  • -o output_directory — specify the directory the recovered files are copied to. by default this is xfs_undeleted relative to the current directory 💜
  • -s start_inode — specify the inode number the recovery should be started at. this must be an existing inode number in the source filesystem, as the inode trees are traversed until this particular number is found. this option may be used to pickup a previously interrupted recovery 🔥 by default, the recovery is started with the first inode existing.
  • -m magicfiles — specify an alternate list of files and directories containing magic. this can be a single item, or a colon-separated list. if a compiled magic file is found alongside a file or directory, it will be used instead. this option is passed to the file utility in verbatim if specified ✨
  • --no-remount-readonly — this is a convenience option meant for the case you need to recover files from your root filesystem, which you cannot umount or remount read-only at the time you want to run xfs_undelete. the sane solution would be moving the harddisk with that particular file system to another computer where it isn't needed for operation 🙈

if you refuse to be that sane, you have to make sure the filesystem was umounted or remounted read-only at least in the meantime by another means, for example by doing a reboot. otherwise you won't be able to recover recently deleted files 😭

USE THIS OPTION AT YOUR OWN RISK. as the source filesystem isn't remounted read-only when you specify this option, you may accidentally overwrite your source filesystem with the recovered files. xfs_undelete checks if you accidentally specified your output directory within the mount hierarchy of your source filesystem and refuses to do such nonsense. however, automatic checks may fail, so better check your specification of the output directory by hand. twice. it must reside on a different filesystem 💀🔥
  • -l — shows a list of filetypes suitable for use with the -r, -i, and -z options, along with common name as put by the file utility 👑

🦋 FILETYPES 🦋

the filetypes as used with the -r, -i, and -z options are a comma-separated list of patterns. patterns of the form */* are matched against known mimetypes, all others are matched against known file extensions. the file extensions are guessed from the file contents with the help of the file utility, so they don't neccessarily are the same the file had before deletion 👀

start xfs_undelete with the -l option to get a list of valid file types ✨

Note: you want to quote the list of filetypes to avoid the shell doing wildcard expansion. seriously bestie, quote it 🫶

🌈 EXAMPLES 🌈

# cd ~ ; xfs_undelete /dev/mapper/cr_data

this stores the recovered files from /dev/mapper/cr_data in the directory ~/xfs_undeleted 💖

# xfs_undelete -o /mnt/external_harddisk /dev/sda3

this stores the recovered files from /dev/sda3 in the directory /mnt/external_harddisk 💖

# xfs_undelete -t 2020-03-19 /dev/sda3

this ignores files deleted before March 19th, 2020 ⭐

# xfs_undelete -t -1hour /dev/sda3

this ignores files deleted more than one hour ago. the -t option accepts all dates understood by Tcl's [clock scan] command ⭐

# xfs_undelete -i "" -t -2hour /dev/sda3

this recovers all files deleted not more than two hours ago, including "bin" files 🎀

# xfs_undelete -r 'image/*,gimp-*' /dev/sda3

this only recovers files matching any image/ mimetype plus those getting assigned an extension starting with gimp- 🖼️✨

😭 TROUBLESHOOTING 😭

when operating on devices, this program must be run as root, as it remounts the source filesystem read-only to put it into a consistent state 🔥 this remount may fail if the filesystem is busy e.g. because it's your /home or / filesystem and there are programs having files opened in read-write mode on it. stop those programs e.g. by running fuser -m /home or ultimately, put your computer into single-user mode to have them stopped by init. if you need to recover files from your / filesystem, you may want to reboot, then use the --no-remount-readonly option, but the sane option is to boot from a different root filesystem instead, for example by connecting the harddisk with the valueable deleted files to another computer 🙈

you also need some space on another filesystem to put the recovered files onto as they cannot be recovered in place. if your computer only has one huge xfs filesystem, you need to connect external storage 💀

if the recovered files have no file extensions, or if the -r, -i, and -z options aren't functional, check with the -l option if the file utility functions as intended. if the returned list is very short, the file utility is most likely not installed or the magic files for the file utility, often shipped extra in a package named file-magic are missing, or they don't feature mimetypes 😭

👑 SEE ALSO 👑

xfs(5), fuser(1), clock(n), file(1)

💜 AUTHORS 💜

Jan Kandziora <jjj@gmx.de>

okay that's the whole thing bestie, you're so welcome 💅✨ this page is from November 2020, xfs_undelete(8), System Manager's Manual — go forth and recover your files responsibly, mwah 🎀🦋

📦 where this page comes from