Top Programs For Data Recovery From XFS File System

We present our TOP programs for Data Recovery from the XFS file system. Let ‘s figure out how they work, how well they can read data from disks with a damaged XFS file system.

XFS is a journaled filesystem, but unlike ext filesystems, only metadata changes are written to the journal. This file system is currently the default on Red Hat-based distributions. Among the disadvantages are the impossibility of reducing the size, the difficulty of Data Recovery and the risk of losing files during recording if there is an unexpected power outage, since most of the data is in memory.

The structure of the file system and the search algorithm for lost data :

Before proceeding to the program test, let’s analyze the structure of the file system. The entire XFS file system is divided into so-called Allocation Groups, an analogue of Block groups in Ext2FS.

Size/count and other description – The Selection Group is in a superblock, and the superblock is at the beginning of each of the Selection Groups (same as in Ext2).

Selection Group Structure :

At least the first 2 KB of each Selection Group is in the same format. Zero Selection Group (and with it the zero superblock) is located right at the beginning of the device.

Data Recovery

The Selection group is divided into four more structures:

  • Superblock
  • Information about free blocks
  • Information about dedicated and free information nodes
  • Blocks allocated for expanding B-trees

The XFS file system is a B-tree. Therefore, the data lies in the leaves of this tree, and in order to get to them, the data recovery program needs to go through this chain. If you remove some elements from this chain, the utility may not find the path to the data.

In B-trees, keys are combined into blocks of several pieces, which makes it possible to significantly increase their efficiency on disk media. All leaves are located on the same (lowest) level, and each block (unless it is a single root leaf) must be at least half full (with keys).

Later in the test, we will see the results of scanning deleted Facebook data from the XFS file system and try to remove some elements from the structure of the file system and see how the programs from our top handle it.

Tests & Comparison :

In Windows, you can view the contents of a removable drive (flash drive, external hard drive) with the XFS file system only using special utilities or by installing a special driver. Data recovery programs allow you to see such a device and recover data from it.

For tests, we have selected some of the most popular data recovery programs: Hetman Partition Recovery, Reclaime, UFS Explorer, Disk Internals, Diskdrill, Active@Uneraser, File Scavenger.