Saturday, August 22, 2020

XFS Deleted File Recovery

 XFS is a high performance Linux file system.  Unlike NTFS, recovering deleted files is not always possible, but CnW have developed tools to assist.  The results can be mixed, but normally better than just data carving.

XFS comes in a few flavours, but until recently CnW Recovery did not support file version 5.  The changes between earlier version and version 5 are small in overall design, but almost every internal data structure has been changed.  The most critical iNode is now twice the length at 0x200 bytes.  All structures now have increased security including a (unique) parent UUID as part of their structure.

CnW version 5.45 now supports all current versions of XFS


No comments:

Post a Comment