XFS Deleted File Recovery

Unlike EXT file systems, substantial residue remains when files are deleted from an XFS file system. Deleted directory entries with visible inode information remain in the “slack” space of the directory file. Extent data in the inode is still visible, and so on. The real hurdle is lack of reasonable forensic tools for this file system.

Using low-level file system debugging tools, we can examine the available information and locate the deleted file content on disk. This session features a live demo of the process.