Undelete files on AIX
1 Highlight features of data recovery tool for AIX
2 Search recoverable data for free
2.1 Download and install free list tool
2.3 Identify recoverable files
2.3.1 Identify recoverable files by full path-name
2.3.2 Identify recoverable files by filename
2.3.3 Identify recoverable files by metadata
3.2.1 All small files recovery license
1 Highlight features of data recovery tool for AIX
Free list tool downloadable from https://www.compunix.com/aix-undelete.php:
List tool permits listing all recoverable files for free.
List tool has same recovery algorithms as licensed tool that performs recovery.
Non-intrusive recovery tool:
Only read access required to logical volume.
Recovery tool will not make any changes to logical volume that is subject of recovery.
No root permissions required except when user and group credentials must be restored.
Deleted data is restored to separate file-system to preserve integrity of original logical volume.
No changes written or fsck used to original logical volume to reconstruct files on different filesystem.
Intuitive tool with command line prompt :
Use cd and ls commands to identify recoverable files.
Use cp and recoverdir command to copy deleted files back to regular filesystem.
Quick scan for analysis, works good for most recoveries.
Deep scan to analyse complete file-system for better recovery in case of massive deletions or complex directory structures:
finds more deleted files
identify more file-names of deleted files
better reconstruction of directory structures, especially in the case of recursive deletions
Capability of recovering partial recoverable files.
Status file saved for fast restart after first execution of tool.
2 Search recoverable data for free
2.1 Download and install free list tool
The list tool to perform analysis what files are recoverable can be downloaded from https://www.compunix.com/aix-undelete.php
After selecting the AIX version and pressing the download button, the executable file vxfslist.bin (where x is the AIX version) with size around 240KB will be downloaded and should be saved to your hard disk. File must be transferred to the system on which recovery must take place.
Attention: the downloaded executable may NOT be installed on the same filesystem where the files have been deleted. Installing the executable on the same filesystem where files are deleted may overwrite your deleted valuable data.
Prior starting the first analysis, binary must be made executable:
chmod a+x vxfslist.bin
Execution of list tool:
for recovery of deleted files:
vxfslist /dev/hdxx
for performing deep scan for recovery of more deleted files:
vxfslist -deep /dev/hdxx
deep scan is automatically activated for small filesystems
for identifying also partially recoverable files:
vxfslist -p 80 /dev/hdxx
will scan for files recoverable between 80% and 100%
recovery from crfs executed on existing JFS2 filesystem:
vxfslist -uncrfs /dev/hdxx
When analysis completed, but not sure how to interpret the result, execute the following command at the prompt of the analysis tool :
report > /tmp/compunix.report
and the send the file /tmp/compunix.report for analysis to info@compunix.com.
2.2 Output free list tool
Information to be provided before at beginning of analysis:
Identify Oracle: only to be activated when recovering Oracle databases: tool will search for tablespace names in recovered files. In case no filenames can be reconstructed, this helps to identify recoverable tablespaces.
Usage of status file: if status file is available from previous execution, it can be used to continue recovery without the need of performing complete analysis again.
Is saved automatically and contains all information from analysis.
Default directory of status-file /var/compunix
Directory and name of statusfile can be changed with arguments ‘-savefile filename’
Output of tool consists of following elements
Software version of tool and AIX, filesystem type: (JFS or JFS2)
Deep search activated or not
Progress indicators.
At end of analysis:
If status file already exist, confirmation for over-writing status file.
Summary of analysis:
Deep analysis activated or not.
Ordering information for recovery license:
CPU-ID
License Class : I, II, III or IV, based on filesystem size:
Class I : filesystems smaller than 100GB.
Class II: filesystems smaller than 500GB.
Class III: filesystems smaller than 2500GB.
Class IV: unlimited filesystem sizes.
Statistics on files recoverable:
number of files (and total size) recoverable with license ‘small files only’
number of files (and total size) recoverable with license ‘all files’
Filetypes of recoverable files:
top 10 types of recoverable files
For each type, number of recoverable files is reported
In case of ‘Oracle’, information on identified tablespaces is reported.
2.3 Identify recoverable files
At command prompt, using 'cd', 'pwd' and 'ls' look for files that can be recovered.
Tools shows the following information for each file:
filename when available
file metadata:
timestamp, size, user, group
license required: <s> for small license, <l> for all files license
file type or first few bytes of file
At end of directory listing, statistics on:
number of small files recoverable by ‘small files’ license
number of files recoverable by ‘all file’ license.
Overall recovery flow is as follows:
2.3.1 Identify recoverable files by full path-name
The interactive prompt will start in the root directory of the filesystem. Ls output will show in which directories files can be recovered. The number behind the / indicated the number of recoverable files.
Following is a case where 2 files have been deleted in directory /dir3/sub1, here the command to execute to see if these files are recoverable :
Current directory / > ls ⬅ show files recoverable in root-directory of filesystem Current directory / rwxr-xr-x 256 Jul 22 10:22 [.]/2 (directory) rwxr-xr-x 256 Jul 22 10:22 [..]/2 (directory) r-xr-xr-x .INODES/2 rwxr-x--- 256 Jul 22 10:25 [dir3]/2 (directory) ⬅ /2 indicates two files recoverable Total bytes regular files 0 in this sub-directory Current directory / > cd dir3 ⬅ change to sub-directory dir3 Current directory /dir3 > ls ⬅ show files recoverable in directory /dir3 Current directory /dir3 rwxr-x--- 256 Jul 22 10:25 [.]/2 (directory) rwxr-xr-x 256 Jul 22 10:22 [..]/2 (directory) rwxr-x--- 16384 Jul 22 10:33 [sub1]/2 (directory) Total bytes regular files 0 Current directory /dir3 > cd sub1 ⬅ change to sub-directory dir3/sub1 Current directory /dir3/sub1 > ls ⬅ show files recoverable in directory /dir3/sub1 Current directory /dir3/sub1 rwxr-x--- 16384 Jul 22 10:33 [.]/2 (directory) rwxr-x--- 256 Jul 22 10:25 [..]/2 (directory) rw-r----- 249856 Jul 22 10:24 rsct.core.auditrm.2.3.10.0.bff <s> (backup/restore format file) rw-r----- 270954496 Jul 22 10:24 sysmgt.websm.webmin.5.2.0.105.bff <l> (backup/restore format file) Total bytes regular files 271204352
If all deleted files identify, proceed with requiring recovery key and software 3 Recovery license.
If not all found, proceed with recovery by filename only.
2.3.2 Identify recoverable files by filename
Sometimes it is not possible to recreate the full pathname of the recoverable file. If deleted files not found in previous step, check out directory /.INODES
Current directory / > ls ⬅ show files recoverable in root-directory of filesystem Current directory / rwxr-xr-x 256 Jul 22 10:22 [.]/2 (directory) rwxr-xr-x 256 Jul 22 10:22 [..]/2 (directory) r-xr-xr-x .INODES/2 ⬅ /2 indicates two files recoverable rwxr-x--- 256 Jul 22 10:25 [dir3]/2 (directory) Total bytes regular files 0 Current directory / > cd .INODES ⬅ change to sub-directory .INODES Current directory /.INODES > ls ⬅ show files recoverable in directory /.INODES Current directory /.INODES rwxr-x--- 16384 Jul 22 10:33 [.]/2 (directory) rwxr-x--- 256 Jul 22 10:25 [..]/2 (directory) rw-r----- 249856 Jul 22 10:24 rsct.core.auditrm.2.3.10.0.bff <s> (backup/restore format file) rw-r----- 270954496 Jul 22 10:24 sysmgt.websm.webmin.5.2.0.105.bff <l> (backup/restore format file) Total bytes regular files 271204352
The recovery tools shows all recoverable files into this directory. This includes deleted directories for which the path to the root directory of the filesystem could not be reconstructed.
If all deleted files identify, proceed with acquiring recovery key and software at 3.Recovery license.
If not all files found, go to next step
2.3.3 Identify recoverable files by metadata
When a filedata is recoverable but not the filename, the directory /.INODES has an entry to this recoverable data. In case of JFS2, all file metadata remains available:
file user and group
file type
timestamp
If all deleted files identify, proceed with acquiring recovery key and software at 3.Recovery license.
If not all files found, go to next step.
2.3.4 More in depth analysis
When additional data must be found for recovery, following extra steps should be taken:
if analysis was performed without deep scan, re-run tool with option ‘-deep’ and perform analysis again 2.3.Identify recoverable files.
if partially recoverable files are of interest of recovery, for example 70% recoverable files, rerun with ‘-p 70’ and perform analysis again 2.3.Identify recoverable files.
When analysis completed, but not sure how to interpret the result, execute the following command at the prompt of the analysis tool :
report > /tmp/compunix.report
and the send the file /tmp/compunix.report for analysis to info@compunix.com.
3 Recovery license
3.1 License selection
Following flow diagram describes how to select which license is most suitable for a specific recovery situation.
3.2 Purchase online license
3.2.1 All small files recovery license
Small files license permits the recovery of files smaller than 10MB. License can be purchased at https://www.compunix.com/pur-prod/purchase-download.php. From drop-down ‘Select recovery license’, select ‘undelete all recoverable files smaller than 10MB (‘small files license’)’:
3.2.2 All files recovery license
‘All files’ license permits the recovery of all files (small and large). ‘All files’ license can be purchased at https://www.compunix.com/pur-prod/purchase-download.php. From drop-down ‘Select recovery license’, select ‘undelete all recoverable files (‘all files license’)’:
3.2.3 On-demand license
On-demand license can be purchased at
https://www.compunix.com/pur-prod/purchase-download.php.
From drop-down ‘Select recovery license’, select ‘on-demand’:
3.2.4 Recovery code for a single file
Recovery code for a file can be purchases in following two cases:
A ‘small file license’ was purchased but the file you need to recover is a big file.
A ‘on-demand license’ was purchased. In this situation a recovery code must be acquired for each file that must be undeleted.
Recovery code can be purchased at https://www.compunix.com/pur-prod/purchase-download.php. From drop-down ‘Select recovery license’, select ‘Recovery code for one single file’: