Skip to content

Commit

Permalink
added automatic trimming of trailing zeroes for certain filetypes
Browse files Browse the repository at this point in the history
  • Loading branch information
ianka committed Apr 15, 2020
1 parent e658831 commit 088df8f
Show file tree
Hide file tree
Showing 3 changed files with 30 additions and 5 deletions.
6 changes: 3 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ In addition, you need enough space on another filesystem to store all the recove
## Limitations
- The way XFS deletes files makes it impossible to recover the filename or the path. You cannot undelete only certain files. The tool however has a mechanism only to recover files deleted since a certain date. See the -t option.
- The way XFS deletes files makes it impossible to recover heavily fragmented files. For typical 512 byte inodes, you can only recover files having at maximum 21 extents (of arbitrary size). Files with more extents cannot be recovered at all by this program.
- The way XFS deletes files makes it impossible to retrieve the correct file size. Most files will be padded with zeroes so they fit the XFS block size. Most programs do not bother anyway.
- The way XFS deletes files makes it impossible to retrieve the correct file size. Most files will be padded with zeroes so they fit the XFS block size. Most programs do not bother anyway. Files of the text/ mimetypes get their trailing zeroes trimmed by default after recovery. See the -z option to change this behaviour.

## How to use it

Expand All @@ -69,9 +69,9 @@ This ignores files deleted more than one hour ago. The -t option accepts all dat

This recovers all files deleted not more than one hour ago, including “bin” files.

# xfs_undelete -r png,gif /dev/sda3
# xfs_undelete -r 'image/*,gimp-*' /dev/sda3

This only recovers png and gif files.
This only recovers files matching any image/ mimetype plus those getting assigned an extension starting with gimp-.

Please understand the file extensions *xfs_undelete* understands are guessed from the MIME type the *file* utility reports.
It is not neccessarily the same file extension the file had before you deleted it.
Expand Down
26 changes: 24 additions & 2 deletions xfs_undelete
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,26 @@ proc investigateInodeBlock {ag block} {
}
}

## Remove trailing zeroes for those files with extensions or mimetypes from the trailing zero list.
if {[matchFiletype [split [dict get $::parameters z] ,] $mimetype $extension]} {
## Open the the recovered file. No character set nor crlf translation.
set rfd [open $rof r+]
fconfigure $rfd -translation binary

## Read last block and trim trailing zeroes.
seek $rfd -$::blocksize end
set lastblock [string trimright [read $rfd $::blocksize] \0]

## Rewrite last block.
seek $rfd -$::blocksize end
puts -nonewline $rfd $lastblock
chan truncate $rfd

## Close recovered file.
close $rfd
}


## Log.
puts stderr [format $::rmformat $rof]
}
Expand Down Expand Up @@ -254,6 +274,7 @@ if {[catch {set parameters [cmdline::getoptions argv {
{t.arg "" "deleted since"}
{r.arg "*" "list of file extensions and mimetypes to recover"}
{i.arg "bin" "list of file extensions and mimetypes to ignore"}
{z.arg "text/*" "list of file extensions and mimetypes to remove all trailing zeroes from"}
{o.arg "xfs_undeleted" "target directory for recovered files"}
{m.arg "" "magic path passed to the 'file' utility"}
{l "list file extensions understood"}
Expand Down Expand Up @@ -410,15 +431,16 @@ foreach line [split $result \n] {
}


## Open filesystem image for binary reading.
## Open filesystem image.
if {[catch {open $fs r} fd]} {
puts stderr "Opening of filesystem failed. $fd"
exit 32
}

## No character set translation.
## No character set nor crlf translation.
fconfigure $fd -translation binary


## Create lost+found directory if nonexistent.
if {[catch {file mkdir [dict get $::parameters o]} err]} {
puts stderr "Cannot create output directory. $err"
Expand Down
3 changes: 3 additions & 0 deletions xfs_undelete.man
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,9 @@ Only recover files with a filetype matching a pattern from this \fBcomma\fR-sepa
\fB\-i\fR \fIfiletypes\fR
Ignore files with a filetype matching a pattern from this \fBcomma\fR-separated list of patterns. Patterns of the form */* are matched against known mimetypes, all others are matched against known file extensions. (The file extensions are guessed from the file contents with the help of the \fBfile\fR utility, so they don't neccessarily are the same the file had before deletion.) See the \fB-l\fR option for a list of valid file types. By default this list is set to \fIbin\fR; all files of unknown type are being ignored, but also see the \fB-r\fR option. \fBNote:\fR you may want to quote the list to avoid the shell doing the wildcard expansion.
.TP
\fB\-z\fR \fIfiletypes\fR
Remove trailing zeroes from all files with a filetype matching a pattern from this \fBcomma\fR-separated list of patterns. Patterns of the form */* are matched against known mimetypes, all others are matched against known file extensions. (The file extensions are guessed from the file contents with the help of the \fBfile\fR utility, so they don't neccessarily are the same the file had before deletion.) See the \fB-l\fR option for a list of valid file types. By default this list is set to \fItext/*\fR; all files of text/* mimetype have their trailing zeroes removed. \fBNote:\fR you may want to quote the list to avoid the shell doing the wildcard expansion.
.TP
\fB\-o\fR \fIoutput_directory\fR
Specify the directory the recovered files are copied to. By default this is \fIxfs_undeleted\fR relative to the current directory.
.TP
Expand Down

0 comments on commit 088df8f

Please sign in to comment.