xfs_irecover

Name
Syntax
Description
Options
Caveats
See also

Name

xfs_irecover — recover deleted inodes from XFS filesystems

Syntax

xfs_irecover [-n] [-N max_inodes] [-r start_inode] [-s size_cutoff] [-t size_threshold] -D device -o output_dir

Description

xfs_irecover scans the given block device for XFS inodes and extracts them. Since most filesystems do not zero the actual data, but merely mark it unused after it has been deleted, recovery is usually possible while the data has not been overwritten. A set of heuristics, controllable via options, determines which inodes are to be considered containing nonsensical data and ignore those.

Options

-D device

The block device or other plain file to scan. Pipes and sockets are not supported, as xfs_irecover makes use of seeking.

-N max_inodes

Sets the maximum number of inodes to scan. This is generally used for debug. The default is the amount of inodes that xfs_db reports for the filesystem.

-n

Dry run. Do not write any extracted inodes to the target directory.

-r start_inode

Specifies at which inode xfs_recover shall start. This is generally used for debug, or to restart a previously aborted xfs_irecover. The default is 0 (start of device).

-s size_cutoff

Inodes that have a recorded file size above this limit are considered to have been overwritten in some way already, and will be ignored during extraction. The default is 1 GB.

-t size_threshold

It can occur that an inode has a recorded file size that is smaller than the size of the extent blocks. If the recorded size is smaller than size_threshold, all extents will be extracted and the file not be truncated to the recorded size. (This heuristic is for when the recorded file size is believed to have been trashed.) Good values are in the range of 4096-65536. The default is 0, meaning files will always be truncated to the recorded size.

Caveats

xfs_irecover currently extracts inodes only, so filenames will not be extracted. In-use bitmaps are ignored (they most likely are trashed or already cleaned), as this tool searches for the real lost or cleared inodes (even the intentionally deleted ones way before a recovery was needed).