accidentally deleted very large file (3.5TB) but still available through loop device

accidentally deleted very large file (3.5TB) but still available through loop device

[Chris Allen]

[-- Attachment #1.1: Type: text/plain, Size: 1067 bytes --]

Hi,

In a nutshell, I did the following:

1. dd if=some_filesystem_dump of=some_file (where some_file resides on 
an XFS filesystem and is 3.5TB large)

2. losetup /dev/loop0 some_file

3. mount /dev/loop0 /recovered

[.... i can now access my recovered filesystem through /recovered ...]

4. rm some_file (remotely via an nfs export) (oops!)

So, I just removed my 3.5TB file even though it is attached to the loop 
device and mounted (XFS did this almost instantly).


Now it *appears* that the filesystem as attached to /dev/loop0 and 
mounted on /recovered is still OK. I
can cd around it and copy files off.

So I have these questions:


1. Is there any way I can get back the 1 file that I accidentally 
deleted (nothing else has been written to that partition since)

2. Am I safe in accessing my filesystem through /dev/loop0 and 
/recovered even though the underlying file has been zapped? If so
I can quickly copy everything off onto another partition.

3. Will this command: dd if=/dev/loop0 of=saved_file get my file back?


Many thanks for any advice!



[-- Attachment #1.2: Type: text/html, Size: 1413 bytes --]

[-- Attachment #2: Type: text/plain, Size: 121 bytes --]

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: accidentally deleted very large file (3.5TB) but still available through loop device

[Eric Sandeen]

Chris Allen wrote:
> Hi,
> 
> In a nutshell, I did the following:
> 
> 1. dd if=some_filesystem_dump of=some_file (where some_file resides on
> an XFS filesystem and is 3.5TB large)
> 
> 2. losetup /dev/loop0 some_file
> 
> 3. mount /dev/loop0 /recovered
> 
> [.... i can now access my recovered filesystem through /recovered ...]
> 
> 4. rm some_file (remotely via an nfs export) (oops!)
> 
> So, I just removed my 3.5TB file even though it is attached to the loop
> device and mounted (XFS did this almost instantly).
> 
> 
> Now it *appears* that the filesystem as attached to /dev/loop0 and
> mounted on /recovered is still OK. I
> can cd around it and copy files off.
> 
> So I have these questions:
> 
> 
> 1. Is there any way I can get back the 1 file that I accidentally
> deleted (nothing else has been written to that partition since)

I thought that maybe an open fd could be found in /proc, but it seems not.

> 2. Am I safe in accessing my filesystem through /dev/loop0 and
> /recovered even though the underlying file has been zapped? If so
> I can quickly copy everything off onto another partition.

The file is still held open by the loop device, so yes, it should be
just fine.  It doesn't really go away until you unmount & unhook the
loopback device.

> 3. Will this command: dd if=/dev/loop0 of=saved_file get my file back?

I'd suggest:

# xfs_freeze -f /recovered
# dd if=/dev/loop0 of=saved_file
# xfs_freeze -u /recovered

to be sure you get a consistent view of the fs.

-Eric

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: accidentally deleted very large file (3.5TB) but still available through loop device

[Martin Steigerwald]

Am Donnerstag 26 März 2009 schrieb Chris Allen:
> Hi,

Hi Chris,

> In a nutshell, I did the following:
>
> 1. dd if=some_filesystem_dump of=some_file (where some_file resides on
> an XFS filesystem and is 3.5TB large)
>
> 2. losetup /dev/loop0 some_file
>
> 3. mount /dev/loop0 /recovered
>
> [.... i can now access my recovered filesystem through /recovered ...]
>
> 4. rm some_file (remotely via an nfs export) (oops!)
>
> So, I just removed my 3.5TB file even though it is attached to the loop
> device and mounted (XFS did this almost instantly).
>
>
> Now it *appears* that the filesystem as attached to /dev/loop0 and
> mounted on /recovered is still OK. I
> can cd around it and copy files off.
>
> So I have these questions:
>
>
> 1. Is there any way I can get back the 1 file that I accidentally
> deleted (nothing else has been written to that partition since)

dd if=/dev/loop0 of=somefile-restore

should work IMHO.

> 2. Am I safe in accessing my filesystem through /dev/loop0 and
> /recovered even though the underlying file has been zapped? If so
> I can quickly copy everything off onto another partition.

Yes. XFS as other linux filesystems perform the real delete - i.e. freeing 
the blocks the file occupies - only after the last user of it has closed 
it. Before just the directory entry of the file is removed.

> 3. Will this command: dd if=/dev/loop0 of=saved_file get my file back?

I think it will. Just try it.

Ciao,
-- 
Martin 'Helios' Steigerwald - http://www.Lichtvoll.de
GPG: 03B0 0D6C 0040 0710 4AFA  B82F 991B EAAC A599 84C7

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: accidentally deleted very large file (3.5TB) but still available through loop device

[Chris Allen]

Eric Sandeen wrote:
> Chris Allen wrote:
>   
>> Hi,
>>
>> In a nutshell, I did the following:
>>
>> 1. dd if=some_filesystem_dump of=some_file (where some_file resides on
>> an XFS filesystem and is 3.5TB large)
>>
>> 2. losetup /dev/loop0 some_file
>>
>> 3. mount /dev/loop0 /recovered
>>
>> [.... i can now access my recovered filesystem through /recovered ...]
>>
>> 4. rm some_file (remotely via an nfs export) (oops!)
>>
>> So, I just removed my 3.5TB file even though it is attached to the loop
>> device and mounted (XFS did this almost instantly).
>>
>>     
> I'd suggest:
>
> # xfs_freeze -f /recovered
> # dd if=/dev/loop0 of=saved_file
> # xfs_freeze -u /recovered
>
> to be sure you get a consistent view of the fs.
>
> -Eric
>   

Many thanks to those who have replied. This solution does indeed work 
perfectly and
I have recovered my lost file.

Chris.

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: accidentally deleted very large file (3.5TB) but still available through loop device

[Matthias Schniedermeyer]

On 26.03.2009 15:41, Chris Allen wrote:
> Hi,
>
> In a nutshell, I did the following:
>
> 1. dd if=some_filesystem_dump of=some_file (where some_file resides on  
> an XFS filesystem and is 3.5TB large)
>
> 2. losetup /dev/loop0 some_file
>
> 3. mount /dev/loop0 /recovered
>
> [.... i can now access my recovered filesystem through /recovered ...]
>
> 4. rm some_file (remotely via an nfs export) (oops!)
>
> So, I just removed my 3.5TB file even though it is attached to the loop  
> device and mounted (XFS did this almost instantly).
>
>
> Now it *appears* that the filesystem as attached to /dev/loop0 and  
> mounted on /recovered is still OK. I
> can cd around it and copy files off.
>
> So I have these questions:
>
>
> 1. Is there any way I can get back the 1 file that I accidentally  
> deleted (nothing else has been written to that partition since)

Unfortunatly not directly. You can't create a directory entry for an 
inode. It was discussed a few years back, but rejected for security 
reasons. (I speak for the kernel in general, i don't know if there is a 
XFS specific thing to create a directory entry for an inode.)

> 2. Am I safe in accessing my filesystem through /dev/loop0 and  
> /recovered even though the underlying file has been zapped? If so

Yes. You are saved by the standard unix semantics of "only delete a file 
if it's reference count is 0". A directory entry counts and having a file 
open also counts.

> I can quickly copy everything off onto another partition.

As long as you don't reboot/umount the partition you are in no hurry.

Only Murphy can really ruin your day now. ;-)

> 3. Will this command: dd if=/dev/loop0 of=saved_file get my file back?

Yes, but:
- You should drop the caches before starting the copy:
echo 3 > /proc/sys/vm/drop_caches
- You should not touch the filesystem while copying. Especially you 
shouldn't write anything. The "view" of the upper- and underside 
(Filesystem vs. backing-store) are NOT kept in sync by the kernel. So it 
is best not to touch the filesystem.

You can also:
xfs_freeze the filesystem (see man xfs_freeze)

or umount the filesystem if the entry in "/etc/mtab" does NOT mention 
"loop=/dev/loop<whatever>" or if you delete if before umounting.
Because umount will only free the loop-device if there is a "loop=" or 
with the parameter "-d" (see man umount)




Bis denn

-- 
Real Programmers consider "what you see is what you get" to be just as 
bad a concept in Text Editors as it is in women. No, the Real Programmer
wants a "you asked for it, you got it" text editor -- complicated, 
cryptic, powerful, unforgiving, dangerous.

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs