Dear XFS developers, Recently we had the unfortunate event of having a large amount of files deleted from an XFS network NAS (via NFS) where a removal of files was performed (leaving intact) the files behind. I've been looking for forensic tools and, hopefully, tools that allow me to recover the files (hopefully their filenames too). Reading several passages of different books and websites, I have found TCT (The Cororer's Toolkit) and the Sleuthkit, but neither of them offer support for XFS. I would like to know if the development team carries such tools - tools that allow one to list the inodes of the XFS filesystem of deleted files, and tools that allow one to cat (dump) the blocks from a starting inode to all the following blocks until an indication that the file is ended or a new indication of a new file appears. (these tools would correspond to TCT's ils and pcat respectively). Perhaps, if not, could you point me out to any tools (commercial or not) that can restore the files of the XFS filesystem - preferibly with their filenames? From the opensource perspective, I have looked at photorec & testdisk (it does not support XFS), and the results were files without filenames - the filenames are key since they are generated though a hash for my application - without these it is really hard to determine where they belong to. Commercial restoring tools like UFS Explorer (only seems to be able to restore without the filename) and DiskDoctors XFS (it doesn't work with disk images) After doing a little test on a pen drive, trying to simulate the real environment (several TBs in a RAID5 arrangement), I've noticed that a "dd if=/my.img | strings | grep -i 'my_movie' ", returns the movie filename several times - so another question I have is, what does this filename represent, the fact that I have it on the filesystem several times, stored as a string, is it an indication that the file and its filename can be associated during a restoring process? Any assistance is greatly appreciated, Best regards, James ---------- Forwarded message ---------- From: Arkadiusz Miskiewicz <misiek@xxxxxxxxxx> Date: Tue, Jul 6, 2010 at 2:07 AM Subject: Re: Need assistance on XFS undeleting files To: James Shih <shija03@xxxxxxxxx> On Tuesday 06 of July 2010, you wrote: > Hello Mr. Miśkiewicz, > > Sorry for soliciting to you in such a way, but I am simply trying to > look for the proper contacts and direction that can help me in a > computer crisis that has recently taken place under an XFS NAS. Please ask on xfs@xxxxxxxxxxx which is dedicated xfs mailing list with xfs developers reading it. Google for list archives, too. > Does XFS provide any type of tools to do file recovery? I don't know such tools unfortunately, so this task will be really hard. > Thank you, > > James Shih. -- Arkadiusz Miśkiewicz PLD/Linux Team arekm / maven.pl http://ftp.pld-linux.org/ _______________________________________________ xfs mailing list xfs@xxxxxxxxxxx http://oss.sgi.com/mailman/listinfo/xfs
