Monday, August 23, 2010

Deleted XFS files

XFS is a popular file structure for NAS devices, both single disk and RAID. A RAID device may be resilient against disk failure (with the exception of RAID 0), but there is nothing to prevent operator error deleting files. With a NTFS disk, a deleted file is marked as deleted, and much of the meta data remains, although the area of the disk that the file used, could be reused.

XFS is less friendly in that the main data within the critical iNode is blanked. Thus flags indicating if it is a directory or file are blanked, along with the file length. Also, the table that stores the locations of all iNodes is also blanked, or filled with irrelevant values. Recovery is therefore deemed as all but impossible.

My challenge this week is to try and disprove this. iNodes still exist, as do cluster runs and resident data within the iNode. Watch this space to see if progress is made. I doubt a solution will be perfect, and there will always be the danger of producng files with a corrupted file structure, but I am curre ntly convinced that something will be possible.

No comments:

Post a Comment