Re: accidently deleted files from directory

[Timothy Shimmin <tes@sgi.com>]

gert wohlgemuth wrote:
> Hi and thx for your help,
> 
> I'm running a gentoo box and using xfs as file system.
> 
> On the weekend it happens that I accidentally deleted 1 TB of data (rm -rdf
> /mnt/lcq). We have no backup of the data (internal reasons of the
> university...) and it would be nice to get the data somehow back.
> 
> After the delete the first step was to unmount the partion and this are the
> info's from the xfs_check program.
> 
> meta-data=/mnt/lcq               isize=256    agcount=32, agsize=9154978
> blks
>          =                       sectsz=512
> data     =                       bsize=4096   blocks=292959296, imaxpct=25
>          =                       sunit=0      swidth=0 blks, unwritten=1
> naming   =version 2              bsize=4096
> log      =internal               bsize=4096   blocks=32768, version=1
>          =                       sectsz=512   sunit=0 blks
> realtime =none                   extsz=65536  blocks=0, rtextents=0
> 
> after I did a cat /dev/sda1 | less I could see that some data are still
> exist and are not overwritten. So I think "all" what I have todo is some how
> get the journal back.
> 
What journal would that be?
If you are referring to the xfs journal or log, then that won't help you.
It is just logging metadata.
It is also only designed for replay for metadata which didn't make it to disk.

> Is there anyway or is all hope lost?
We don't support undelete as the FAQ says :)
I suggest you go thru the mailing list archive and see if anyone has suggestions
for scanning the device. Good luck :)

--Tim