1 Highlight features of data recovery tool for AIX

Free list tool downloadable from https://www.compunix.com/aix-undelete.php:

• List tool permits listing all recoverable files for free.

• List tool has same recovery algorithms as licensed tool that performs recovery.

Non-intrusive recovery tool:

• Only read access required to logical volume.

• Recovery tool will not make any changes to logical volume that is subject of recovery.

• No root permissions required except when user and group credentials must be restored.

• Deleted data is restored to separate file-system to preserve integrity of original logical volume.

• No changes written or fsck used to original logical volume to reconstruct files on different filesystem.

Intuitive tool with command line prompt :

• Use cd and ls commands to identify recoverable files.

• Use cp and recoverdir command to copy deleted files back to regular filesystem.

Quick scan for analysis, works good for most recoveries.

Deep scan to analyse complete file-system for better recovery in case of massive deletions or complex directory structures:

• finds more deleted files

• identify more file-names of deleted files

• better reconstruction of directory structures, especially in the case of recursive deletions

Capability of recovering partial recoverable files.

Status file saved for fast restart after first execution of tool.

2 Search recoverable data for free

2.1 Download and install free list tool

The list tool to perform analysis what files are recoverable can be downloaded from https://www.compunix.com/aix-undelete.php

After selecting the AIX version and pressing the download button, the executable file vxfslist.bin (where x is the AIX version) with size around 240KB will be downloaded and should be saved to your hard disk. File must be transferred to the system on which recovery must take place.

Attention: the downloaded executable may NOT be installed on the same filesystem where the files have been deleted. Installing the executable on the same filesystem where files are deleted may overwrite your deleted valuable data.

Prior starting the first analysis, binary must be made executable:

chmod a+x vxfslist.bin

Execution of list tool:

• for recovery of deleted files:

  • vxfslist /dev/hdxx

• for performing deep scan for recovery of more deleted files:

• vxfslist -deep /dev/hdxx

• deep scan is automatically activated for small filesystems

• for identifying also partially recoverable files:

  • vxfslist -p 80 /dev/hdxx

  • will scan for files recoverable between 80% and 100%

• recovery from crfs executed on existing JFS2 filesystem:

  • vxfslist -uncrfs /dev/hdxx

When analysis completed, but not sure how to interpret the result, execute the following command at the prompt of the analysis tool :

report > /tmp/compunix.report

and the send the file /tmp/compunix.report for analysis to info@compunix.com.

2.2 Output free list tool

Information to be provided before at beginning of analysis:

• Identify Oracle: only to be activated when recovering Oracle databases: tool will search for tablespace names in recovered files. In case no filenames can be reconstructed, this helps to identify recoverable tablespaces.

• Usage of status file: if status file is available from previous execution, it can be used to continue recovery without the need of performing complete analysis again.

  • Is saved automatically and contains all information from analysis.

  • Default directory of status-file /var/compunix

  • Directory and name of statusfile can be changed with arguments ‘-savefile filename’

Output of tool consists of following elements

• Software version of tool and AIX, filesystem type: (JFS or JFS2)

• Deep search activated or not

• Progress indicators.

At end of analysis:

• If status file already exist, confirmation for over-writing status file.

• Summary of analysis:

  • Deep analysis activated or not.

  • Ordering information for recovery license:

    • CPU-ID

    • License Class : I, II, III or IV, based on filesystem size:

      • Class I : filesystems smaller than 100GB.

      • Class II: filesystems smaller than 500GB.

      • Class III: filesystems smaller than 2500GB.

      • Class IV: unlimited filesystem sizes.

  • Statistics on files recoverable:

    • number of files (and total size) recoverable with license ‘small files only’

    • number of files (and total size) recoverable with license ‘all files’

  • Filetypes of recoverable files:

    • top 10 types of recoverable files

    • For each type, number of recoverable files is reported

  • In case of ‘Oracle’, information on identified tablespaces is reported.

2.3 Identify recoverable files

At command prompt, using 'cd', 'pwd' and 'ls' look for files that can be recovered.

Tools shows the following information for each file:

• filename when available

• file metadata:

  • timestamp, size, user, group

• license required: <s> for small license, <l> for all files license

• file type or first few bytes of file

At end of directory listing, statistics on:

• number of small files recoverable by ‘small files’ license

• number of files recoverable by ‘all file’ license.

Overall recovery flow is as follows:

2.3.1 Identify recoverable files by full path-name

The interactive prompt will start in the root directory of the filesystem. Ls output will show in which directories files can be recovered. The number behind the / indicated the number of recoverable files.

Following is a case where 2 files have been deleted in directory /dir3/sub1, here the command to execute to see if these files are recoverable :

Current directory /
>  ls   ⬅ show files recoverable in root-directory of filesystem
Current directory /
rwxr-xr-x       256 Jul 22 10:22 [.]/2 (directory)
rwxr-xr-x       256 Jul 22 10:22 [..]/2        (directory)
r-xr-xr-x                           .INODES/2
rwxr-x---       256 Jul 22 10:25 [dir3]/2      (directory) ⬅ /2 indicates two files recoverable
Total bytes regular files          0				in this sub-directory
Current directory /
> cd dir3   ⬅ change to sub-directory dir3 
Current directory /dir3
> ls	⬅ show files recoverable in directory /dir3
Current directory /dir3
rwxr-x---       256 Jul 22 10:25 [.]/2 (directory)
rwxr-xr-x       256 Jul 22 10:22 [..]/2        (directory)
rwxr-x---     16384 Jul 22 10:33 [sub1]/2      (directory)
Total bytes regular files          0
Current directory /dir3
> cd sub1  ⬅ change to sub-directory dir3/sub1
Current directory /dir3/sub1
> ls	⬅ show files recoverable in directory /dir3/sub1
Current directory /dir3/sub1
rwxr-x---     16384 Jul 22 10:33 [.]/2 (directory)
rwxr-x---       256 Jul 22 10:25 [..]/2        (directory)
rw-r-----    249856 Jul 22 10:24 rsct.core.auditrm.2.3.10.0.bff <s>    (backup/restore format file)
rw-r----- 270954496 Jul 22 10:24 sysmgt.websm.webmin.5.2.0.105.bff <l> (backup/restore format file)
Total bytes regular files  271204352

If all deleted files identify, proceed with requiring recovery key and software 3 Recovery license.

If not all found, proceed with recovery by filename only.

2.3.2 Identify recoverable files by filename

Sometimes it is not possible to recreate the full pathname of the recoverable file. If deleted files not found in previous step, check out directory /.INODES

Current directory /
>  ls   ⬅ show files recoverable in root-directory of filesystem
Current directory /
rwxr-xr-x       256 Jul 22 10:22 [.]/2 (directory)
rwxr-xr-x       256 Jul 22 10:22 [..]/2        (directory)
r-xr-xr-x                           .INODES/2	⬅ /2 indicates two files recoverable
rwxr-x---       256 Jul 22 10:25 [dir3]/2      (directory) 
Total bytes regular files          0			
Current directory /
> cd .INODES   ⬅ change to sub-directory .INODES
Current directory /.INODES
> ls	⬅ show files recoverable in directory /.INODES
Current directory /.INODES
rwxr-x---     16384 Jul 22 10:33 [.]/2 (directory)
rwxr-x---       256 Jul 22 10:25 [..]/2        (directory)
rw-r-----    249856 Jul 22 10:24 rsct.core.auditrm.2.3.10.0.bff <s>    (backup/restore format file)
rw-r----- 270954496 Jul 22 10:24 sysmgt.websm.webmin.5.2.0.105.bff <l> (backup/restore format file)
Total bytes regular files  271204352

The recovery tools shows all recoverable files into this directory. This includes deleted directories for which the path to the root directory of the filesystem could not be reconstructed.

If all deleted files identify, proceed with acquiring recovery key and software at 3.Recovery license.

If not all files found, go to next step

2.3.3 Identify recoverable files by metadata

When a filedata is recoverable but not the filename, the directory /.INODES has an entry to this recoverable data. In case of JFS2, all file metadata remains available:

• file user and group

• file type

• timestamp

If all deleted files identify, proceed with acquiring recovery key and software at 3.Recovery license.

If not all files found, go to next step.

2.3.4 More in depth analysis

When additional data must be found for recovery, following extra steps should be taken:

• if analysis was performed without deep scan, re-run tool with option ‘-deep’ and perform analysis again 2.3.Identify recoverable files.

• if partially recoverable files are of interest of recovery, for example 70% recoverable files, rerun with ‘-p 70’ and perform analysis again 2.3.Identify recoverable files.

When analysis completed, but not sure how to interpret the result, execute the following command at the prompt of the analysis tool :

report > /tmp/compunix.report

and the send the file /tmp/compunix.report for analysis to info@compunix.com.

3 Recovery license

3.1 License selection

Following flow diagram describes how to select which license is most suitable for a specific recovery situation.

3.2 Purchase online license

3.2.1 All small files recovery license

Small files license permits the recovery of files smaller than 10MB. License can be purchased at https://www.compunix.com/pur-prod/purchase-download.php. From drop-down ‘Select recovery license’, select ‘undelete all recoverable files smaller than 10MB (‘small files license’)’:

3.2.2 All files recovery license

‘All files’ license permits the recovery of all files (small and large). ‘All files’ license can be purchased at https://www.compunix.com/pur-prod/purchase-download.php. From drop-down ‘Select recovery license’, select ‘undelete all recoverable files (‘all files license’)’:

3.2.3 On-demand license

On-demand license can be purchased at https://www.compunix.com/pur-prod/purchase-download.php. From drop-down ‘Select recovery license’, select ‘on-demand’:

3.2.4 Recovery code for a single file

Recovery code for a file can be purchases in following two cases:

1. A ‘small file license’ was purchased but the file you need to recover is a big file.

2. A ‘on-demand license’ was purchased. In this situation a recovery code must be acquired for each file that must be undeleted.

Recovery code can be purchased at https://www.compunix.com/pur-prod/purchase-download.php. From drop-down ‘Select recovery license’, select ‘Recovery code for one single file’: