{"id":5407,"date":"2023-08-02T16:49:30","date_gmt":"2023-08-02T21:49:30","guid":{"rendered":"https:\/\/www.incredigeek.com\/home\/?p=5407"},"modified":"2023-08-08T23:46:22","modified_gmt":"2023-08-09T04:46:22","slug":"how-to-undelete-files-on-xfs-filesystem","status":"publish","type":"post","link":"https:\/\/www.incredigeek.com\/home\/how-to-undelete-files-on-xfs-filesystem\/","title":{"rendered":"How to Undelete Files on XFS Filesystem"},"content":{"rendered":"\n<p>There are a couple different options for undeleting files for XFS filesystems.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">TestDisk<\/h2>\n\n\n\n<p>TestDisk is a great command line recovery tool.  Unfortunately, it can be slightly more difficult on systems using XFS compared to EXT4 systems.  TestDisk does not support undeleting a file in place on XFS.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image.png\"><img loading=\"lazy\" decoding=\"async\" width=\"650\" height=\"230\" src=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image.png\" alt=\"\" class=\"wp-image-5408\" srcset=\"https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image.png 650w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image-300x106.png 300w, https:\/\/www.incredigeek.com\/home\/wp-content\/uploads\/2023\/08\/image-500x177.png 500w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/a><\/figure>\n\n\n\n<p>You can still recover files using TestDisk, you just need to recover the whole drive and dig through the recovery results to find the files you want.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">xfs_undelete<\/h2>\n\n\n\n<p>There is also another utility that can be helpful. xfs_undelete<\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/ianka\/xfs_undelete\">https:\/\/github.com\/ianka\/xfs_undelete<\/a><\/p>\n\n\n\n<p>It allows for a little more flexibility in recovering files.  For instance, you can specify to recover the files from the past hour to recover.<\/p>\n\n\n\n<p>Download prerequisites <\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo dnf install tcllib\nwget https:\/\/raw.githubusercontent.com\/ianka\/xfs_undelete\/master\/xfs_undelete\nchmod u+x .\/xfs_undelete\n\n.\/xfs_undelete<\/pre>\n\n\n\n<p>Example of running xfs_undelete<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">.\/xfs_undelete -t -1hour .\/dev\/sda2<\/pre>\n\n\n\n<p>You will need a different filesystem to save the files to.  Otherwise you will receive the following error.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Your output directory is  \/home\/bob\/recovery\/\nThat is within the filesystem  \/  you want to recover files\nfrom. This isn't feasible as it would overwrite the deleted files you wanted to\nrecover. Please specify the option -o \/path\/to\/output_directory on another (rw\nmounted) filesystem or run xfs_undelete from within a directory on that\nfilesystem so the recovered files could be written there. They cannot be\nrecovered in place.<\/pre>\n\n\n\n<p>It&#8217;s not the greatest idea to recover on the system while running.  Ideally, shut the system down, plug the drive into another machine as read only, and copy the files off.<\/p>\n\n\n\n<p>You could also boot up in single user mode or a live Linux iso\/thumbdrive and mount another recovery drive.  Should work for both physical and virtual environments.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>There are a couple different options for undeleting files for XFS filesystems. TestDisk TestDisk is a great command line recovery tool. Unfortunately, it can be slightly more difficult on systems using XFS compared to EXT4 systems. TestDisk does not support &hellip; <a href=\"https:\/\/www.incredigeek.com\/home\/how-to-undelete-files-on-xfs-filesystem\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23,3],"tags":[1389,17,7,219,217,538,1549,1550,1551],"class_list":["post-5407","post","type-post","status-publish","format-standard","hentry","category-centos-linux","category-linux","tag-almalinux","tag-centos","tag-linux-2","tag-photorec","tag-recovery","tag-rhel","tag-testdisk","tag-xfs","tag-xfs_undelete"],"_links":{"self":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/comments?post=5407"}],"version-history":[{"count":2,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5407\/revisions"}],"predecessor-version":[{"id":5410,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/posts\/5407\/revisions\/5410"}],"wp:attachment":[{"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/media?parent=5407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/categories?post=5407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.incredigeek.com\/home\/wp-json\/wp\/v2\/tags?post=5407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}