Undelete XFS file in SGI

khoryh · 12-07-2006, 09:00 AM

Hi all,
I need help and your expertise on XFS. We have accidentally deleted some important files from our SGI XFS system and fortunately we done have backup for the files. Is there any luck that we can still undelete the deleted file on XFS.

I have checked thru a few website but unfortunately the findings are not good. I was told it is impossible to undelete a file in XFS.

Does anyone know any undelete tool that we can use ? Any suggestion would be great. Your input or ideal would be very appreciated. Thank you for sharing.

Kent

jschiwal · 12-07-2006, 09:21 AM

If a service might still have a handle to the files, you could use "lsof" to determine the process that is using them. I'm not certain what you mean by the "SGI". Besides Meaning Silicon Graphics, are you running Linux on an SGI machine rather than a Unix? ( You posted in Linx-General ). If that is the case, and you are using the Linux, then you have the /proc pseudo filesystem. If you haven't rebooted, and since the file is important maybe a background service still has it open. If that is the case, check: lsof | grep <filename>

For example:

Code:

lsof | grep Beagle\.dll
:~> lsof | grep Beagle\.dll
beagled   14474   jschiwal  mem       REG                3,6    38912     180320 /usr/lib64/beagle/Beagle.dll
beagled   14474   jschiwal    7r      REG                3,6    38912     180320 /usr/lib64/beagle/Beagle.dll
beagled-h 19306   jschiwal  mem       REG                3,6    38912     180320 /usr/lib64/beagle/Beagle.dll
beagled-h 19306   jschiwal    8r      REG                3,6    38912     180320 /usr/lib64/beagle/Beagle.dll

cd /proc/14474/fd
jschiwal@hpamd64:/proc/14474/fd> ls -l | grep Beagle\.dll
lr-x------ 1 jschiwal users 64 2006-12-07 08:01 7 -> /usr/lib64/beagle/Beagle.dll

jschiwal@hpamd64:/proc/14474/fd> cat 7 >/tmp/usr_lib64_beagle_Beagle.dll
jschiwal@hpamd64:/proc/14474/fd> file /tmp/usr_lib64_beagle_Beagle.dll
/tmp/usr_lib64_beagle_Beagle.dll: PE executable for MS Windows (DLL) (console) Intel 80386 32-bit, Mono/.Net assembly

If the system or a program still has a handle open on the file, then the directory entry is gone, but the file is still there.

khoryh · 12-07-2006, 09:39 AM

Hi JSChiwal,

Thank you for your advise. Yes, we are running Linux on SGI machine.Some of the deleted files are very old files that I afraid no background service still has it open. Any chances to recover them ? we havent reboot the server.

Thanks again.

Kent

jschiwal · 12-07-2006, 10:52 PM

Sorry, I'm not familiar with the XFS filesystem. For text files, you can use grep or a similar tool to try to locate the file on the device itself. Having located where the file is you can use the dd command with an offset to copy the file. This type of thing is often done from an image of the drive. You might also try looking at the info or man page for the "fine" command. Some files have particular "magic numbers" which could be used to locate the file. The patterns that "file" uses are listed in /usr/share/misc/magic.

Danws · 10-25-2009, 03:09 PM

The relevant thread: Howto: undelete files on XFS