xfs corruption and recovery of files

English Install/Boot/Login
1

Hi folks,

I’ve lost a lot of files when I attempted to repair my /home-partition that is on a xfs-filesystem. After having used the “xfs_repair -L” command, I now have a working system but with a lot of files and folders missing. Is it possible to recover the files somehow?

Here’s a rundown of what I did:

First of, when I tried to boot into my system, I got the following message:


Welcome to emergency mode! After logging in, type "journalct1 -xb" to vie
system logs, "systemct1 reboot" to reboot,  "systemct1 default" to try again
to boot into default mode
Give root password for maintenance
(or press contol-D to continue):
XFS (sda3): Metadata corruption detected at_write_verify+0xd5/0xe0 [xfs], block 0x113e04a8
XFS (sda3): Unmount and run xfs_repair

I logged in, unmounted my home-partition (sda3) and did:


xfs_repair -n /dev/sda3
ERROR: The filesystem has valuable metadata changes in a log which needs to
be replayed.  Mount the filesystem to replay the log, and unmount it before
re-running xfs_check.  If you are unable to mount the filesystem, then use
the xfs_repair -L option to destroy the log and attempt a repair.
Note that destroying the log may cause corruption -- please attempt a mount
of the filesystem before doing this.

I then ran the following commands

xfs_repair -L /dev/sda3
xfs_repair /dev/sda3

As stated above, I now have a working system. But with a lot of files missing. Even my wallpaper and other desktop configuration have been reset.

Although I ran xfs_repair -L and deleted the log with metadata, are the files still on my hard drive? That is, are they still on the hard drive but marked as deleted and therefore not shown? Or are they forever gone since I deleted the log? If the former, can I reverse the process in some way?

2

Restore from backup.

3

May find bits and pieces in lost&found

4

I will, but I have recent files that I haven’t been backed up. Therefore, I want to try to recover the files in some other ways.

Is it possible to recover those files with e.g. rescue tools after having deleted the logfile with metadata?

5

As always, image the partition to preserve a copy of what you have, even if it’s not immediately usable.

Then,
You might try running one or more of the forensic tools that can recover “deleted” or corrupted files… The standard one to try is photorec but there are others. Pentesting suites like Kali will generally have several you can try.

If your “lost” files were simply not readable because of a file system problem, then the files will likely be all (or nearly) recoverable.
On the other hand, if the files actually suffered some kind of damage, then it’ll be YMMV. Depending on the file, perhaps part of the file might be recoverable or the file can be recovered using the file system’s integrity checks. Badly corrupted files will just be lost. Over-written files would be considered “damaged.”

HTH,
TSU

6

Don’t.
Depending on what you are actually referring to, those “logfile with metadata” might actually be helpful if part of your low level file system.

TSU-.