Data recovery software for XFS and ReiserFS
The XFS file system does not allow for deleted files. When a file is deleted in NTFS, a flag is set in the MFT, but all meta data remains. With XFS, the iNode type is cleared, along with file size, and several of the iNode details.
CnW have developed a routine, which is part of the standard software (V3.07 and later) so that a badly corrupted or deleted XFS disk may be recovered. When the disk is recognised as XFS, the Raw Scan option has to be selected to start a fairly long procedure. The first part of the procedure is to scan the whole disk for iNode entries. These are stored in groups of 64 iNodes, and each iNode always starts with the magic bytes ‘IN’. The second part of the procedure is to scan these iNodes to determine which are directories, and hence build up a directory tree. The clever part of the routine is that deleted iNodes are reconstructed by intelligent routines to analyse the remaining bytes, and fill in the missing parts of the iNode. This it can be determined if the iNode is a file entry, or a directory entry. At this stage, the iNodes can be scanned again and files recovered.
When files are deleted, data is lost, but the above procedure has produced some very good results. Most importantly, original file names are retained, and so is the large majority of the directory structure. Occasionally dummy directories, such as ‘lost_dir_2e013’ will be produced, but these can often contain a valid directory structure underneath them.
The CnW demo will should all these files, but will not save then to the hard drive