Yes, I rm'ed the wrong directory. The disk has not been written to since, now mounted ro. Is it possible to recover the files without doing forensics on the whole partition? I know the UID and path. XFS is supposed to be pretty amazing, can I get it to do this?
Thanks, Dave
On 1/7/19 1:28 PM, Dave Burns wrote:
Yes, I rm'ed the wrong directory. The disk has not been written to since, now mounted ro. Is it possible to recover the files without doing forensics on the whole partition? I know the UID and path. XFS is supposed to be pretty amazing, can I get it to do this?
I can't find any reports of successful undelete from XFS.
http://xfs.org/index.php/XFS_FAQ#Q:_Does_the_filesystem_have_an_undelete_cap...
Red Hat suggests xfs_irecover, testdisk, and sleuthkit. Others recommend photorec. I don't see XFS undelete support listed on the web pages for either testdisk or photorec.
Good luck.
-
Dave Burns -
Gordon Messmer