Undelete XFS

Data recovery software for XFS

The XFS file system does not allow for deleted files. Thus recovery should not be possible.

When a file is deleted in NTFS, a flag is set in the MFT, but all meta data remains. With XFS, the iNode type is cleared, along with file size, and several of the iNode details.

CnW have developed a routine, which is part of the standard CnW software so that a badly corrupted or deleted XFS disk may be (partially) recovered. When the disk is recognised as XFS, the Raw Scan option has to be selected to start a fairly long procedure. The first part of the procedure is to scan the whole disk for iNode entries. These are stored in groups of 64 iNodes, and each iNode always starts with the magic bytes ‘IN’. The second part of the procedure is to scan these iNodes to determine which are directories, and hence build up a directory tree. The clever part of the routine is that deleted iNodes are reconstructed by intelligent routines to analyse the remaining bytes, and fill in the missing parts of the iNode. This it can be determined if the iNode is a file entry, or a directory entry. At this stage, the iNodes can be scanned again and files recovered.

When files are deleted, data is lost, but the above procedure has produced some very good results. Most importantly, original file names are retained, and so is the large majority of the directory structure. Occasionally dummy directories, such as ‘lost_dir_2e013’ will be produced, but these can often contain a valid directory structure underneath them. The results can be mixed and range from very good to rather poor. In some cases it may be best use
data carving as well, but this has the problem that no original files names are generated. The two methods used may mean that data can be recovered

Support for XFS File System V5 was added on V5.46 (September 2020). The V5 update to XFS has changed all the internal structures, thus making it incompatible with earlier versions. The iNode size was also increased to 0x200 bytes which means for small files, less than may be 400 bytes, there is a larger chance they may be saved in the iNode. The structures do actually add a lot of extra security, such as identifying each iNode with the main file system. CnW software will eventually make use of these updates for more secure recovery.

Does it work with my disk?
The answer is to
download the demo and run it. You will need to select the Raw files option. The CnW demo will show all these files, but will not save then to the hard drive. The demo will also populate the log. If you view the log you will determine which files will be recovered. A double click of the log entry will display a hex dump of the file.



Symlink files


Symlink files are found on Linux systems but not on Windows/DOS. There are two types, hard and soft. A hard link file is when an iNode points to an existing files.

A soft link is just the file name of the existing file. ie a type of shortcut. As thes type of file do not exist fully in Windows, CnW will save the files with a new file extension, ie "._sml"