Question: Is it possible to recover deleted files from a healthy XFS filesystem?

Question: Is it possible to recover deleted files from a healthy XFS filesystem?

[Bc. Martin Šafránek]

Hello everyone,

I have a question regarding XFS and file recovery.

Is there any method — official or unofficial — to recover deleted files from a healthy, uncorrupted XFS filesystem? I understand that XFS does not support undeletion, but I'm wondering if any remnants of metadata might still allow partial or full recovery, perhaps under specific conditions.

If anyone has insights, tools, or suggestions, I’d be very grateful.

Thank you for your time.

Best regards,
Martin Safranek

Re: Question: Is it possible to recover deleted files from a healthy XFS filesystem?

[Carlos Maiolino]

On Mon, May 05, 2025 at 02:42:22PM +0200, Bc. Martin Šafránek wrote:
> Hello everyone,
> 
> I have a question regarding XFS and file recovery.
> 
> Is there any method — official or unofficial — to recover deleted files from a healthy, uncorrupted XFS filesystem? I understand that XFS does not support undeletion, but I'm wondering if any remnants of metadata might still allow partial or full recovery, perhaps under specific conditions.
> 
> If anyone has insights, tools, or suggestions, I’d be very grateful.
> 
> Thank you for your time.

It all depends on if the file's data have been overwritten or not. We have no
tools to undelete files, but there are a few tools on the market for that.

I've successfully used this tool in the past: https://www.ufsexplorer.com

But I am by no means associated with them, and I have no responsibility to
whatever happens to your data.

I know about other tools too, but I have no experience with them.


> 
> Best regards,
> Martin Safranek
> 
> 

Re: Question: Is it possible to recover deleted files from a healthy XFS filesystem?

[Carlos E. R.]

[-- Attachment #1.1: Type: text/plain, Size: 959 bytes --]

On 2025-05-05 14:42, Bc. Martin Šafránek wrote:
> Hello everyone,
> 
> I have a question regarding XFS and file recovery.
> 
> Is there any method — official or unofficial — to recover deleted files from a healthy, uncorrupted XFS filesystem? I understand that XFS does not support undeletion, but I'm wondering if any remnants of metadata might still allow partial or full recovery, perhaps under specific conditions.
> 
> If anyone has insights, tools, or suggestions, I’d be very grateful.
> 
> Thank you for your time.

There are tools that search the disk blocks trying to find blocks that 
belonged to a file that was deleted. The first step would be to set that 
filesystem to read only, and hopefully, create an image.

I have never tried on an XFS filesystem, so I can't recommend any tool. 
Tools need to know the type of file you want to find.

-- 
Cheers / Saludos,

		Carlos E. R.
		(from 15.6 x86_64 at Telcontar)

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 203 bytes --]

Re: Question: Is it possible to recover deleted files from a healthy XFS filesystem?

[Christoph Hellwig]

A long time ago there was a simple xfs_irecover tool to scan blocks
for inode signatures.  We never managed to port it to use libxfs and
the code repository for it seems to have disappeared.

But in general, yes you can scan for inode clusters that have not been
reused, but it is very low-level and dangerous if you don't know what
you are doing.

Re: Question: Is it possible to recover deleted files from a healthy XFS filesystem?

[Christoph Hellwig]

On Mon, May 05, 2025 at 09:30:32PM -0700, Christoph Hellwig wrote:
> A long time ago there was a simple xfs_irecover tool to scan blocks
> for inode signatures.  We never managed to port it to use libxfs and
> the code repository for it seems to have disappeared.
> 
> But in general, yes you can scan for inode clusters that have not been
> reused, but it is very low-level and dangerous if you don't know what
> you are doing.

If you are looking for specific file types, PhotoRec
(https://www.cgsecurity.org/wiki/PhotoRec) might also be an option.