uaktags Posted January 21, 2021 Share Posted January 21, 2021 Hey guys, So like a few others, i've been hit with a predicament caused by user-error. In a single move, I lost the contents of one of my shares (possibly during a mv command or a sym/hard link moment). While the files lost weren't "important" enough for me to keep a backup of, they were plentiful, and reacquiring would be a far more painful task than the idea of recovery. I saw from a few posts such as: https://forums.unraid.net/topic/92076-whats-the-current-way-to-recover-deleted-files/ https://forums.unraid.net/topic/80815-urgent-problem-how-to-undelete-a-folder/ https://forums.unraid.net/topic/73937-help-recover-deleted-files/ that a few others have fallen through the same user-error as me and didn't have a backup. The common replies were "maybe xfs_undelete" but more possibly "maybe UFS Explorer". For anyone that doesn't know, UFS Explorer is probably the worst company/product experience I have. The "standard" license for recovery is for a product called "UFS Explorer Standard Recovery" but i'd forgive you for accidentally getting their "UFS Professional Recovery" or getting confused with "Recovery Explorer Professional", or "Recovery Explorer Standard". These are all the same company, and for the most part appear to be the same software (just with limitations/abilities added or removed). If you make the mistake and get UFS Professional Recovery's trial, like i did, and start the painstaking 8-11hour scan for lost data.....don't worry, you can NOT use that saved scan on the Standard versions. So, if you mess up like me, you may buy the license for the Standard (~75$) but accidentally download the Recovery Explorer Pro or the UFS Pro Recovery, start a scan, and then realize you don't have the right license nor can you bring the results/scan over to the Standard. In the end though, Standard didn't work at all. It took about 3hours before it errors out and I haven't heard back from support. So I went with "xfs_undelete" instead. So, as mentioned in the other threads, you'll need Nerd Pack to download tcl and tcllib. Then what I did was I stopped my array and mounted some large external storage (truth be told, i mounted an old NAS i had with 4bays, that i had replaced with unraid). Then, after mounting my Destination drive, I basically downloaded xfs_undelete, and used the following parameters to fit my needs. I knew what I was looking for (for me, video files) and I knew a date range of when they were deleted (Jan 9th): xfs_undelete -t 2021-01-09 -r 'video/*' -o /mnt/remotes/nas-drive/xfs_undeleted/ /dev/sdd1 Now, the crappy part is doing it via cifs to the NAS, I can only run this for 1 drive at a time (the CIFS connection becomes unstable), but i reckon i could do this with drives connected via USB or SATA. The results though are awesome! Instead of doing a scan first of everything and waiting for the Virtual Filesystem to be created, and then doing a restore job [UFS Explorers method] this just scans inode by inode and recovers immediately. The filetype allows me to just say every file of this type, rather than waiting for the vFilesystem, so that's great, but it does mean i'm going to get a bunch of junk i don't want since i can't specify filesizes (oh well). Best off...its free, and appears to just work. Hope that helps others looking for similar support! 1 5 Quote Link to comment
Advice Posted January 11, 2022 Share Posted January 11, 2022 Hey, can you give more details on how exactly you installed `xfs_undelete`? I've installed the nerd pack and tcl + tclib, but I don't know how to actually add in `xfs_undelete` to my Unraid server. Quote Link to comment
richardoswald Posted January 22, 2023 Share Posted January 22, 2023 (edited) On 1/11/2022 at 2:24 PM, Advice said: Hey, can you give more details on how exactly you installed `xfs_undelete`? I've installed the nerd pack and tcl + tclib, but I don't know how to actually add in `xfs_undelete` to my Unraid server. 1. SSH into your Unraid (or access the terminal from the ">_" icon in the upper right hand of the GUI) 2. I used wget to get the file (I installed it in my "/etc/" folder) wget https://github.com/ianka/xfs_undelete/archive/refs/tags/v12.0.zip -O temp.zip unzip temp.zip rm temp.zip cd xfs_undelete-12.0/ ./xfs_undelete --help They should get you going. I'm doing a recovery as I type this Good luck with yours! Edited January 22, 2023 by richardoswald 4 Quote Link to comment
huckleberryumyum Posted June 20, 2023 Share Posted June 20, 2023 @uaktags @richardoswald thanks for sharing, I followed your tips and was able to recover a bunch of priceless family photos from a very stupid mistake. Learned a real lesson, but not the hardest way thanks to you two. Quote Link to comment
atraikov Posted August 11, 2023 Share Posted August 11, 2023 @richardoswald @uaktags I just signed up to also thank for this! Literally restored weeks of lost work! Quote Link to comment
Wesiwestside Posted August 18, 2023 Share Posted August 18, 2023 (edited) On 1/22/2023 at 7:04 AM, richardoswald said: 1. SSH into your Unraid (or access the terminal from the ">_" icon in the upper right hand of the GUI) 2. I used wget to get the file (I installed it in my "/etc/" folder) wget https://github.com/ianka/xfs_undelete/archive/refs/tags/v12.0.zip -O temp.zip unzip temp.zip rm temp.zip cd xfs_undelete-12.0/ ./xfs_undelete --help They should get you going. I'm doing a recovery as I type this Good luck with yours! Hey, any pointers on what to do ? I was was moving some videos around, after which i routinely deleted the then empty folders. At 03:30AM I must have accidentaly selected the parent folder and pressed delete. I noticed immidiatly and canceled the deletion but lost 3tb in movies. BtW there was a parity check running. I shut down my server and removed each of the 5 disks. I tried to recover the files with UFS Explorer Standard Recovery but only found empty folders. The cause may be that the movie folder is in a share which has all five disks included. Now i put the disks back in my server and am trying to get it to work with XFS_undelete. I don't seem to get the command right. This is the best i can make from the instructions: ./xfs_undelete -t 2023-08-16..2023-08-18/dev/sdc I also want the restored files to be written to an unnasigned device which i plugged in to the server so: -o/mnt/disks/Overflow/dev/sdc do i type this in the same line?Like: ./xfs_undelete -t 2023-08-16..2023-08-18/dev/sdc -o/mnt/disks/Overflow /dev/sdc Obviously i am rather unexperienced using Commandline so any help will be grately appreciated. Edited August 18, 2023 by Wesiwestside afterthought Quote Link to comment
Wesiwestside Posted August 19, 2023 Share Posted August 19, 2023 1 hour ago, Wesiwestside said: Hey, any pointers on what to do ? I was was moving some videos around, after which i routinely deleted the then empty folders. At 03:30AM I must have accidentaly selected the parent folder and pressed delete. I noticed immidiatly and canceled the deletion but lost 3tb in movies. BtW there was a parity check running. I shut down my server and removed each of the 5 disks. I tried to recover the files with UFS Explorer Standard Recovery but only found empty folders. The cause may be that the movie folder is in a share which has all five disks included. Now i put the disks back in my server and am trying to get it to work with XFS_undelete. I don't seem to get the command right. This is the best i can make from the instructions: ./xfs_undelete -t 2023-08-16..2023-08-18/dev/sdc I also want the restored files to be written to an unnasigned device which i plugged in to the server so: -o/mnt/disks/Overflow/dev/sdc do i type this in the same line?Like: ./xfs_undelete -t 2023-08-16..2023-08-18/dev/sdc -o/mnt/disks/Overflow /dev/sdc Obviously i am rather unexperienced using Commandline so any help will be grately appreciated. root@Tower:~# ^[[200~wget https://github.com/ianka/xfs_undelete/archive/refs/tags/v12.0.zip -O temp.zip ~ bash: $'\E[200~wget': command not found root@Tower:~# wget https://github.com/ianka/xfs_undelete/archive/refs/tags/v12.0.zip -O temp.zip --2023-08-18 15:35:20-- https://github.com/ianka/xfs_undelete/archive/refs/tags/v12.0.zip Resolving github.com (github.com)... 140.82.121.4 Connecting to github.com (github.com)|140.82.121.4|:443... connected. HTTP request sent, awaiting response... 302 Found Location: https://codeload.github.com/ianka/xfs_undelete/zip/refs/tags/v12.0 [following] --2023-08-18 15:35:20-- https://codeload.github.com/ianka/xfs_undelete/zip/refs/tags/v12.0 Resolving codeload.github.com (codeload.github.com)... 140.82.121.10 Connecting to codeload.github.com (codeload.github.com)|140.82.121.10|:443... connected. HTTP request sent, awaiting response... 200 OK Length: unspecified [application/zip] Saving to: ‘temp.zip’ temp.zip [ <=> ] 26.44K --.-KB/s in 0.01s 2023-08-18 15:35:21 (2.26 MB/s) - ‘temp.zip’ saved [27076] root@Tower:~# unzip temp.zip Archive: temp.zip 4c15e5763e1c560b0b6c8dbdc5f1b06d1530d3fc creating: xfs_undelete-12.0/ inflating: xfs_undelete-12.0/LICENSE inflating: xfs_undelete-12.0/README.md inflating: xfs_undelete-12.0/shell.nix inflating: xfs_undelete-12.0/xfs_undelete inflating: xfs_undelete-12.0/xfs_undelete.man root@Tower:~# rm temp.zip root@Tower:~# cd xfs_undelete-12.0/ root@Tower:~/xfs_undelete-12.0# ./xfs_undelete --help xfs_undelete [options] device -- options are: -t value deleted since <> -T value modified since <> -r value list of file extensions and mimetypes to recover <*> -i value list of file extensions and mimetypes to ignore <bin> -z value list of file extensions and mimetypes to remove all trailing zeroes from <text/*> -o value target directory for recovered files <xfs_undeleted> -s value restart at inode number <> -m value magic path passed to the 'file' utility <> -l list file extensions understood -no-remount-readonly do not remount read-only before recovery -- Forcibly stop option processing -help Print this message -? Print this message root@Tower:~/xfs_undelete-12.0# xfs_undelete -t 2023-08-16 /dev/sdc bash: xfs_undelete: command not found root@Tower:~/xfs_undelete-12.0# -t 2023-08-16 /dev/sdc bash: -t: command not found root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16 /dev/sdc This isn't an XFS filesystem or filesystem image. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16 /dev/sde This isn't an XFS filesystem or filesystem image. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16 /dev/sdb This isn't an XFS filesystem or filesystem image. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16/dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16../dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16/dev/sdc -o/mnt/external_harddisk/dev/sdi xfs_undelete [options] device -- options are: -t value deleted since <> -T value modified since <> -r value list of file extensions and mimetypes to recover <*> -i value list of file extensions and mimetypes to ignore <bin> -z value list of file extensions and mimetypes to remove all trailing zeroes from <text/*> -o value target directory for recovered files <xfs_undeleted> -s value restart at inode number <> -m value magic path passed to the 'file' utility <> -l list file extensions understood -no-remount-readonly do not remount read-only before recovery -- Forcibly stop option processing -help Print this message -? Print this message root@Tower:~/xfs_undelete-12.0# -o/mnt/external_harddisk/dev/sdi bash: -o/mnt/external_harddisk/dev/sdi: No such file or directory root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -o/mnt/external_harddisk/dev/sdi xfs_undelete [options] device -- options are: -t value deleted since <> -T value modified since <> -r value list of file extensions and mimetypes to recover <*> -i value list of file extensions and mimetypes to ignore <bin> -z value list of file extensions and mimetypes to remove all trailing zeroes from <text/*> -o value target directory for recovered files <xfs_undeleted> -s value restart at inode number <> -m value magic path passed to the 'file' utility <> -l list file extensions understood -no-remount-readonly do not remount read-only before recovery -- Forcibly stop option processing -help Print this message -? Print this message root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16..2023-08-18/dev/sdc -o/mnt/external_harddisk/dev/sdi xfs_undelete [options] device -- options are: -t value deleted since <> -T value modified since <> -r value list of file extensions and mimetypes to recover <*> -i value list of file extensions and mimetypes to ignore <bin> -z value list of file extensions and mimetypes to remove all trailing zeroes from <text/*> -o value target directory for recovered files <xfs_undeleted> -s value restart at inode number <> -m value magic path passed to the 'file' utility <> -l list file extensions understood -no-remount-readonly do not remount read-only before recovery -- Forcibly stop option processing -help Print this message -? Print this message root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16..2023-08-18/dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16..-6hours/dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t -96hours/dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -o/mnt/disks/Overflow/dev/sdc xfs_undelete [options] device -- options are: -t value deleted since <> -T value modified since <> -r value list of file extensions and mimetypes to recover <*> -i value list of file extensions and mimetypes to ignore <bin> -z value list of file extensions and mimetypes to remove all trailing zeroes from <text/*> -o value target directory for recovered files <xfs_undeleted> -s value restart at inode number <> -m value magic path passed to the 'file' utility <> -l list file extensions understood -no-remount-readonly do not remount read-only before recovery -- Forcibly stop option processing -help Print this message -? Print this message root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t -96hours../dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t -96hours../dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 6hours../dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t <-96hours..>/dev/sdc bash: -96hours..: No such file or directory root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16 -r 'video/*' -o /mnt/disks/Overflow/xfs_undeleted/ /dev/sdc This isn't an XFS filesystem or filesystem image. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16 -r 'video/*' -o /mnt/disks/Overflow/ /dev/sdc This isn't an XFS filesystem or filesystem image. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16 -r 'video/*' -o /mnt/disks/Overflow//dev/sdc Please specify a block device or an XFS filesystem image. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16..2023-08-18 -r 'video/*' -o /mnt/disks/Overflow/dev/sdc Please specify a block device or an XFS filesystem image. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16..2023-08-18 Please specify a block device or an XFS filesystem image. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-08-16..2023-08-18/dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ./xfs_undelete -t 2023-16-08..2023-18-08/dev/sdc Unable to parse time range. Please put it as a range of time specs Tcl's [clock scan] can understand, e.g. 2022-06-04..-2hours. A single value as -2hours is considered the same as a range -2hours..now. root@Tower:~/xfs_undelete-12.0# ^C root@Tower:~/xfs_undelete-12.0# xfs_undelete -t 2023-08-16 -r 'video/*' -o /mnt/disks/Overflow/xfs_undeleted/ /dev/sdc bash: xfs_undelete: command not found root@Tower:~/xfs_undelete-12.0# Im looking into installing the GNU Coreutils now. Quote Link to comment
BRiT Posted August 19, 2023 Share Posted August 19, 2023 (edited) I think you want to run this on the unraid device such as /dev/md# so you're doing it on the drives inside the parity protected array. If you run it on /dev/sdx#/ then you are invalidating the parity since you are writing below the devicemapper. Also, you need to run it on a partition, such as /dev/sdc1 (first partition). Specifying /dev/sdc is for the entire drive. That is why it can't find any valid filesystems.. The /dev/md# syntax may have changed on 6.12 unraid versions for ZFS tomfoolery, so check what the right device name is. I'm still on 6.11 where it's /dev/md1 for first partition of the first drive in the array. Only use /dev/sdX1 if you are recovering to another drive. Edited August 19, 2023 by BRiT 1 Quote Link to comment
Wesiwestside Posted August 19, 2023 Share Posted August 19, 2023 (edited) Firstly thanks a lot. like this? I still don't get whats wrong with my time range input. Is the md# part supposed to point to the whole array? Couldn't figur out where to get the info? My best guess was System devices. Where does it say on your system? Well it seems to be working. Edited August 20, 2023 by Wesiwestside Quote Link to comment
Gico Posted August 24, 2023 Share Posted August 24, 2023 Just used it and worked like a charm. Thanks! To find source mdX (mine is disk9): lsblk | grep disk9 md9p1 9:9 0 10.9T 0 md /mnt/disk9 I knew that nothing writes to the array disk but tried the -no-remount-readonly switch and for some reason it didn't work and the partition was remounted as read only. ./xfs_undelete -t 2023-08-24..2023-08-25 -r 'video/*' -o /mnt/p2ppool/Temp/ /dev/md9p1 -no-remount-readonly /dev/md9p1 (/dev/md9p1) is currently mounted read-write. Trying to remount read-only. Remount successful. Starting recovery. Recovered file -> /mnt/p2ppool/Temp/2023-08-24-18-13_4297004664.matroska Recovered file -> /mnt/p2ppool/Temp/2023-08-24-18-14_4297004665.matroska Recovered file -> /mnt/p2ppool/Temp/2023-08-24-18-14_4297004666.matroska Recovered file -> /mnt/p2ppool/Temp/2023-08-24-18-14_4297004667.matroska Recovered file -> /mnt/p2ppool/Temp/2023-08-24-18-14_4297004668.matroska Recovered file -> /mnt/p2ppool/Temp/2023-08-24-18-14_4297004669.matroska Done. To remount the partition as read/write: root@Juno:/mnt/p2ppool/Temp/xfs_undelete-12.1# sudo mount -o remount,rw /dev/md9p1 Quote Link to comment
Alatalos Posted October 8, 2023 Share Posted October 8, 2023 Hi, Just a question, what do you do with the *.matroska files? Quote Link to comment
Kilrah Posted October 8, 2023 Share Posted October 8, 2023 .mkv stands for "matroska video" so as it seems there xfs_undelete just recovered files it cannot identify but supposes are matroska files... i.e. rename to .mkv and see if they work/what they are. Quote Link to comment
Ludditus Posted November 25, 2023 Share Posted November 25, 2023 Just want to add another shout out for Recovery Explorer. I had inadvertently wiped out most of my media share, RE allowed me to recover about 90% of the deleted files to an external drive. The rest I was able to pull down from an old AWS Glacier backup. It definitely was painstaking trying to figure out which recovered files went where, but at least it was possible. And now, I have learned a valuable lesson and set most of my media share directories to read-only. 😒 Quote Link to comment
CybranNakh Posted November 28, 2023 Share Posted November 28, 2023 (edited) Could someone help me with this? I had used this command perfect in 6.11.x but now in 6.12.x, I am pulling my hair out. I keep getting "This isn't an XFS filesystem or filesystem image." Here is what I have done: 1) xfs_undelete was installed on my unassigned device 2) I confirmed the download of dependencies needed with nerd pack 3) Stopped the array 4) Cd into the xfs folder 5) ./xfs_undelete -t 2023-09-01 -o /mnt/disks/temp /dev/md1p1 This isn't an XFS filesystem or filesystem image. I have tried /dev/sdj , /dev/sdj1, /dev/md1, /dev/mdp1 to no avail. Any adivse? Thank you!!!! Edit: SOLVED. I am using XFS encrypted which makes it impossible, I believe for xfs_undelete to even recognize it as the correct file system. Luckily, my data was first on an unassigned device which I could use undelete on. I need better backup protocols for data on the array it looks like! Edited November 28, 2023 by CybranNakh Solved my problem Quote Link to comment
JonathanM Posted December 1, 2023 Share Posted December 1, 2023 On 11/28/2023 at 1:17 PM, CybranNakh said: I am using XFS encrypted On 11/28/2023 at 1:17 PM, CybranNakh said: I need better backup protocols Definitely. Any data that is encrypted becomes very difficult or impossible to recover when there is a file system error. Encryption makes backup even more important. Quote Link to comment
Kilrah Posted December 1, 2023 Share Posted December 1, 2023 On 11/28/2023 at 7:17 PM, CybranNakh said: I am using XFS encrypted which makes it impossible, I believe for xfs_undelete to even recognize it as the correct file system. You can, but you need to first manually unlock the drive with luksOpen. Quote Link to comment
ianka Posted January 9 Share Posted January 9 @CybranNakh To recover files from an encrypted filesystem, you have to point xfs_undelete to the LVM device /dev/mapper/whateveritisnamedonyourmachine that handles the decryption instead of /dev/md1p1 or whatever the mdraid device is. Quote Link to comment
b3lc Posted January 24 Share Posted January 24 (edited) Lost 4TB+ of files, new drive to be used with xfs_undelete already in its way here... a question though: As my data is/was spread along the data array, should I run this program for every drive on the array separately? do I need to run it separately for every /dev/sd#1? or perhaps for every /dev/md#p1? it doesn't seem it would work that way but I guess I got that information wrong.. Thank you and sorry if I'm highjacking this post. It's just that I've seen people redirecting other posts to this one and didn't want to create a new one so results are consolidated. Edited January 24 by b3lc Quote Link to comment
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.