* Fwd: Need assistance on XFS undeleting files
[not found] ` <201007060807.24582.misiek@pld.org.pl>
@ 2010-07-06 11:16 ` James Shih
2010-07-06 12:17 ` Andi Kleen
0 siblings, 1 reply; 3+ messages in thread
From: James Shih @ 2010-07-06 11:16 UTC (permalink / raw)
To: xfs
Dear XFS developers,
Recently we had the unfortunate event of having a large amount of
files deleted from an XFS network NAS (via NFS) where a removal of
files was performed (leaving intact) the files behind. I've been
looking for forensic tools and, hopefully, tools that allow me to
recover the files (hopefully their filenames too). Reading several
passages of different books and websites, I have found TCT (The
Cororer's Toolkit) and the Sleuthkit, but neither of them offer
support for XFS.
I would like to know if the development team carries such tools -
tools that allow one to list the inodes of the XFS filesystem of
deleted files, and tools that allow one to cat (dump) the blocks from
a starting inode to all the following blocks until an indication that
the file is ended or a new indication of a new file appears. (these
tools would correspond to TCT's ils and pcat respectively).
Perhaps, if not, could you point me out to any tools (commercial or
not) that can restore the files of the XFS filesystem - preferibly
with their filenames? From the opensource perspective, I have looked
at photorec & testdisk (it does not support XFS), and the results were
files without filenames - the filenames are key since they are
generated though a hash for my application - without these it is
really hard to determine where they belong to. Commercial restoring
tools like UFS Explorer (only seems to be able to restore without the
filename) and DiskDoctors XFS (it doesn't work with disk images)
After doing a little test on a pen drive, trying to simulate the
real environment (several TBs in a RAID5 arrangement), I've noticed
that a "dd if=/my.img | strings | grep -i 'my_movie' ", returns the
movie filename several times - so another question I have is, what
does this filename represent, the fact that I have it on the
filesystem several times, stored as a string, is it an indication that
the file and its filename can be associated during a restoring
process?
Any assistance is greatly appreciated,
Best regards,
James
---------- Forwarded message ----------
From: Arkadiusz Miskiewicz <misiek@pld.org.pl>
Date: Tue, Jul 6, 2010 at 2:07 AM
Subject: Re: Need assistance on XFS undeleting files
To: James Shih <shija03@gmail.com>
On Tuesday 06 of July 2010, you wrote:
> Hello Mr. Miśkiewicz,
>
> Sorry for soliciting to you in such a way, but I am simply trying to
> look for the proper contacts and direction that can help me in a
> computer crisis that has recently taken place under an XFS NAS.
Please ask on xfs@oss.sgi.com which is dedicated xfs mailing list with xfs
developers reading it. Google for list archives, too.
> Does XFS provide any type of tools to do file recovery?
I don't know such tools unfortunately, so this task will be really hard.
> Thank you,
>
> James Shih.
--
Arkadiusz Miśkiewicz PLD/Linux Team
arekm / maven.pl http://ftp.pld-linux.org/
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
^ permalink raw reply [flat|nested] 3+ messages in thread